nodejs.yml

# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
name: Node.js CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
jobs:
  # building project
  build:
    name: Build
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        node-version: [18.x]
        os: [ubuntu-latest]
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}

      - name: Cache NPM
        uses: actions/cache@v3
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Cache Elm
        uses: actions/cache@v3
        with:
          path: ~/.elm
          key: ${{ runner.os }}-elm-${{ hashFiles('**/elm.json') }}
          restore-keys: |
            ${{ runner.os }}-elm-

      - name: Download dependencies
        run: npm ci

      - name: Build
        run: npm run build --if-present

      - name: Running Test
        run: npm test

  # CVE scanning
  cvescan:
    name: CVE Scanning
    runs-on: ubuntu-latest
    needs: [build]
    strategy:
      matrix:
        node-version: [18.x]
    steps:
      - uses: actions/checkout@v4
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
      - run: npm ci
      - run: npx --yes auditjs ossi --whitelist allow-list.json

  # Semgrep static code analysis
  semgrep:
    name: Semgrep
    runs-on: ubuntu-latest
    needs: [cvescan]
    container:
      # A Docker image with Semgrep installed. Don't change this.
      image: returntocorp/semgrep
    # Skip any PR created by dependabot to avoid permission issues
    if: (github.actor != 'dependabot[bot]')
    steps:
      - uses: actions/checkout@v4
      - run: semgrep scan --config auto --severity ERROR
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}