scan-code.yml

# Tests that rely on the committed code, without needing the docker images to be built
name: Scan ClimateTrax FE

on: [push]

concurrency:
  group: caller-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
    trivy-scan-code:
        runs-on: ubuntu-latest
        timeout-minutes: 60
        steps:
          - name: Checkout code
            uses: actions/checkout@v3
          - name: Cache Scan Dependencies
            uses: actions/cache@v2
            with:
              path: ~/.cache/trivy
              key: ${{ github.workflow }}-${{ github.run_id }}
              restore-keys: trivy-
          - name: Run Trivy vulnerability scanner in repo mode
            uses: aquasecurity/trivy-action@master
            with:
              scan-type: fs
              format: sarif
              output: trivy-results.sarif
              exit-code: "0"
              ignore-unfixed: false
              severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
              timeout: 10m0s
          - name: Upload Trivy scan results as artifact 
           # can't use the Advanced Security feature for the result uploading
           # as it is only for a public repo or a private repo within GitHub Enterprise 
            uses: actions/upload-artifact@v2
            with:
              name: trivy-results
              path: trivy-results.sarif

    call-workflow-trivy-scan:
      uses: button-inc/button-shared-gh-actions/.github/workflows/trivy-scan-code.yml@develop         

    install-dev-tools:
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@v2
        - name: Set up Node.js
          uses: actions/setup-node@v2
          with:
            node-version: '18' # Change this to the Node.js version your project supports
        - name: Get yarn cache directory path
          id: yarn-cache-dir-path
          run: echo "::set-output name=dir::$(yarn cache dir)"
        - uses: actions/cache@v2
          id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
          with:
            path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
            key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
            restore-keys: |
              ${{ runner.os }}-yarn-
        - run: yarn install --frozen-lockfile --check-files
          working-directory: ./app

    husky-checks:
      needs: install-dev-tools
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@v2
        - uses: actions/setup-node@v2
          with:
            node-version: '18'
        - name: Get yarn cache directory path
          id: yarn-cache-dir-path
          run: echo "::set-output name=dir::$(yarn cache dir)"
        - uses: actions/cache@v2
          id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
          with:
            path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
            key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
            restore-keys: |
              ${{ runner.os }}-yarn-
        - run: yarn install 
          working-directory: ./app
        - run: npm run lint
          working-directory: ./app
    
    gitleaks: 
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@v3
          with:
            fetch-depth: 0
        - uses: gitleaks/gitleaks-action@v2
          env:
            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
            GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}}
            GITLEAKS_NOTIFY_USER_LIST: "@shon-button,@YaokunLin"