casecomp/.github/workflows/ci.yml at main · Pyronewbic/casecomp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  security-events: write

jobs:
  unit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
        with:
          node-version: 24
      - run: npm install
      - run: node test/unit-test.js

  smoke:
    continue-on-error: true
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
        with:
          node-version: 24
      - run: npm install
      - name: Get Playwright version
        id: pw-version
        run: echo "version=$(npx playwright --version | awk '{print $2}')" >> $GITHUB_OUTPUT
      - name: Cache Playwright browsers
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        id: pw-cache
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ steps.pw-version.outputs.version }}
      - name: Install Playwright browsers
        if: steps.pw-cache.outputs.cache-hit != 'true'
        run: npx playwright install chromium --with-deps
      - name: Install Playwright deps only
        if: steps.pw-cache.outputs.cache-hit == 'true'
        run: npx playwright install-deps chromium
      - run: node test/smoke-test.js

  api:
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
        with:
          node-version: 24
      - run: npm install
      - name: API tests (no Firestore)
        run: bash scripts/test-api-local.sh

  codeql:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: github/codeql-action/init@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4
        with:
          languages: javascript-typescript
      - uses: github/codeql-action/analyze@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4

  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Generate SBOM (Syft)
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
        with:
          path: .
          format: spdx-json
          output-file: sbom.spdx.json

      - name: Vulnerability scan (Grype)
        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7
        id: grype
        with:
          sbom: sbom.spdx.json
          fail-build: false
          severity-cutoff: critical
          add-cpes-if-none: true

      - name: Upload SBOM
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: sbom-${{ github.sha }}
          path: sbom.spdx.json
          retention-days: 90

      - name: Upload Grype report
        if: always() && steps.grype.outputs.sarif != ''
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: grype-sarif-${{ github.sha }}
          path: ${{ steps.grype.outputs.sarif }}
          retention-days: 90

  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
        with:
          node-version: 24
      - run: npm install
      - name: npm audit (high + critical)
        run: npm audit --audit-level=high || true
      - name: Lockfile lint
        run: npx lockfile-lint --path package-lock.json --type npm --allowed-hosts npm --validate-https

  secrets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@dcedce43c6f43de0b836d1fe38946645c9c638dc # v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}