ci.yaml

name: CI

on:
  push:
    branches:
      - "**"
env:
  GO_VERSION: 1.22

permissions:
  id-token: write
  contents: write

jobs:
  lint:
    name: Lint Code
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - uses: actions/setup-python@v5
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
      - uses: golangci/golangci-lint-action@v6
        with:
          version: v1.62
      - run: |
          pip install -r requirements.txt
          mkdocs build -f ../../mkdocs.yaml --strict
          pip uninstall -r requirements.txt --yes --no-input
        working-directory: tests/docs
      - run: npx prettier . --check

  test:
    name: Test
    needs: [lint, snyk]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v1.7.0
        with:
          role-to-assume: ${{ secrets.ROLE_TO_ASSUME }}
          role-session-name: GitHub_to_AWS_via_FederatedOIDC
          aws-region: ${{ secrets.AWS_REGION }}
      - run: make test

  snyk:
    name: Snyk Scan
    runs-on: ubuntu-latest
    env:
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
      - uses: snyk/actions/setup@master
      - run: |
          python -m venv venv
          source venv/bin/activate
          pip install --upgrade pip
          pip install -r requirements.txt
        working-directory: tests/docs
      - run: >-
          snyk test
          --severity-threshold=medium
          --all-projects
      - run: >-
          snyk code test
          --severity-threshold=medium
          --all-projects

  release:
    name: Release
    needs: [test, snyk]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 20.8.1
      - run: npx semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.PAT_SEMANTIC_RELEASE }}