ci: merge workflows #1125
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| branches: | |
| - develop | |
| - main | |
| - release/** | |
| pull_request: | |
| branches: | |
| - develop | |
| - main | |
| - release/** | |
| workflow_dispatch: | |
| jobs: | |
| phylum-analyze: | |
| if: ${{ github.event.pull_request }} | |
| uses: radixdlt/public-iac-resuable-artifacts/.github/workflows/phylum-analyze.yml@main | |
| permissions: | |
| id-token: write | |
| pull-requests: write | |
| contents: read | |
| deployments: write | |
| secrets: | |
| phylum_api_key: ${{ secrets.PHYLUM_API_KEY }} | |
| with: | |
| phylum_pr_number: ${{ github.event.number }} | |
| phylum_pr_name: ${{ github.head_ref }} | |
| phylum_group_name: dApp-engineering | |
| phylum_project_id: ad50ad22-146e-4339-80ea-d895b4bce133 | |
| github_repository: ${{ github.repository }} | |
| add_report_comment_to_pull_request: true | |
| snyk-scan-deps-licences: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| pull-requests: read | |
| contents: read | |
| deployments: write | |
| steps: | |
| - uses: RDXWorks-actions/checkout@main | |
| - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main | |
| with: | |
| role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access' | |
| app_name: 'radix-dapp-toolkit' | |
| step_name: 'snyk-scan-deps-licenses' | |
| secret_prefix: 'SNYK' | |
| secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/snyk-credentials-rXRpuX' | |
| parse_json: true | |
| - name: Run Snyk to check for deps vulnerabilities | |
| uses: RDXWorks-actions/snyk-actions/node@master | |
| with: | |
| args: --all-projects --org=${{ env.SNYK_PROJECTS_ORG_ID }} --severity-threshold=critical | |
| snyk-scan-code: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| pull-requests: read | |
| contents: read | |
| deployments: write | |
| steps: | |
| - uses: RDXWorks-actions/checkout@main | |
| - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main | |
| with: | |
| role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access' | |
| app_name: 'radix-dapp-toolkit' | |
| step_name: 'snyk-scan-code' | |
| secret_prefix: 'SNYK' | |
| secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/snyk-credentials-rXRpuX' | |
| parse_json: true | |
| - name: Run Snyk to check for code vulnerabilities | |
| uses: RDXWorks-actions/snyk-actions/node@master | |
| continue-on-error: true | |
| with: | |
| args: --all-projects --org=${{ env.SNYK_PROJECTS_ORG_ID }} --severity-threshold=high | |
| command: code test | |
| build: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - snyk-scan-deps-licences | |
| - snyk-scan-code | |
| permissions: | |
| id-token: write | |
| contents: read | |
| steps: | |
| - uses: RDXWorks-actions/checkout@main | |
| - name: Use Node.js | |
| uses: RDXWorks-actions/setup-node@main | |
| with: | |
| node-version: '20.x' | |
| - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main | |
| with: | |
| role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-radix-dapp-toolkit-secrets-read-access' | |
| app_name: 'dapp-toolkit' | |
| step_name: 'npm' | |
| secret_prefix: 'GH' | |
| secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/radixdlt/radix-dapp-toolkit/npm-token-A52rl3' | |
| parse_json: true | |
| - name: Authenticate with private NPM package | |
| run: echo "//registry.npmjs.org/:_authToken=${{ env.GH_NPMJS_TOKEN }}" > ~/.npmrc | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build | |
| run: npm run build | |
| - name: Run tests | |
| run: npm run test | |
| - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main | |
| with: | |
| role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access' | |
| app_name: 'dapp-toolkit' | |
| step_name: 'build' | |
| secret_prefix: 'GH' | |
| secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/sonar-token-CgrUGD' | |
| parse_json: true | |
| - name: SonarCloud Scan | |
| uses: RDXWorks-actions/sonarcloud-github-action@master | |
| with: | |
| projectBaseDir: ./packages/dapp-toolkit | |
| env: | |
| SONAR_TOKEN: ${{ env.GH_SONAR_TOKEN }} | |
| - name: Release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_TOKEN: ${{ env.GH_NPMJS_TOKEN }} | |
| run: | | |
| cd packages/dapp-toolkit | |
| npx semantic-release | tee out | |
| echo "RELEASE_VERSION=$(grep 'Created tag ' out | awk -F 'Created tag ' '{print $2}')" >> $GITHUB_ENV | |
| # Snyk SBOM | |
| - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main | |
| with: | |
| role_name: 'arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access' | |
| app_name: 'radix-dapp-toolkit' | |
| step_name: 'snyk-sbom' | |
| secret_prefix: 'SNYK' | |
| secret_name: 'arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/snyk-credentials-rXRpuX' | |
| parse_json: true | |
| - name: Generate SBOM | |
| uses: RDXWorks-actions/snyk-actions/node@master | |
| with: | |
| args: --all-projects --org=${{ env.SNYK_PROJECTS_ORG_ID }} --format=cyclonedx1.4+json > sbom.json | |
| command: sbom | |
| - name: Upload SBOM | |
| uses: RDXWorks-actions/upload-release-assets@c94805dc72e4b20745f543da0f62eaee7722df7a | |
| with: | |
| files: sbom.json | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| release-tag: ${{ env.RELEASE_VERSION }} |