Skip to content

Commit 5ab7763

Browse files
vorsterkvorsterk
authored
Merge pull request #18 from frmscoe/workflow
Add github workflows
2 parents 42d0fdc + 6c3e12b commit 5ab7763

File tree

5 files changed

+241
-0
lines changed

5 files changed

+241
-0
lines changed

‎.github/workflows/codacy.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow checks out code, performs a Codacy security scan
7+
# and integrates the results with the
8+
# GitHub Advanced Security code scanning feature. For more information on
9+
# the Codacy security scan action usage and parameters, see
10+
# https://github.com/codacy/codacy-analysis-cli-action.
11+
# For more information on Codacy Analysis CLI in general, see
12+
# https://github.com/codacy/codacy-analysis-cli.
13+
14+
name: Codacy Security Scan
15+
16+
on:
17+
push:
18+
branches: [ "main" ]
19+
pull_request:
20+
# The branches below must be a subset of the branches above
21+
branches: [ "main" ]
22+
schedule:
23+
- cron: '17 0 * * 4'
24+
25+
permissions:
26+
contents: read
27+
28+
jobs:
29+
codacy-security-scan:
30+
permissions:
31+
contents: read # for actions/checkout to fetch code
32+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
33+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
34+
name: Codacy Security Scan
35+
runs-on: ubuntu-latest
36+
steps:
37+
# Checkout the repository to the GitHub Actions runner
38+
- name: Checkout code
39+
uses: actions/checkout@v3
40+
41+
# Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
42+
- name: Run Codacy Analysis CLI
43+
uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b
44+
with:
45+
# Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository
46+
# You can also omit the token and run the tools that support default configurations
47+
project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
48+
verbose: true
49+
output: results.sarif
50+
format: sarif
51+
# Adjust severity of non-security issues
52+
gh-code-scanning-compat: true
53+
# Force 0 exit code to allow SARIF file generation
54+
# This will handover control about PR rejection to the GitHub side
55+
max-allowed-issues: 2147483647
56+
57+
# Upload the SARIF file generated in the previous step
58+
- name: Upload SARIF results file
59+
uses: github/codeql-action/upload-sarif@v2
60+
with:
61+
sarif_file: results.sarif

‎.github/workflows/codeql.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: [ "main" ]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: [ "main" ]
20+
schedule:
21+
- cron: '34 0 * * 4'
22+
23+
jobs:
24+
analyze:
25+
name: Analyze
26+
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
27+
permissions:
28+
actions: read
29+
contents: read
30+
security-events: write
31+
32+
strategy:
33+
fail-fast: false
34+
matrix:
35+
language: [ 'javascript' ]
36+
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
37+
# Use only 'java' to analyze code written in Java, Kotlin or both
38+
# Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
39+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
40+
41+
steps:
42+
- name: Checkout repository
43+
uses: actions/checkout@v3
44+
45+
# Initializes the CodeQL tools for scanning.
46+
- name: Initialize CodeQL
47+
uses: github/codeql-action/init@v2
48+
with:
49+
languages: ${{ matrix.language }}
50+
# If you wish to specify custom queries, you can do so here or in a config file.
51+
# By default, queries listed here will override any specified in a config file.
52+
# Prefix the list here with "+" to use these queries and those in the config file.
53+
54+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
55+
# queries: security-extended,security-and-quality
56+
57+
58+
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java).
59+
# If this step fails, then you should remove it and run the build manually (see below)
60+
- name: Autobuild
61+
uses: github/codeql-action/autobuild@v2
62+
63+
# ℹ️ Command-line programs to run using the OS shell.
64+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
65+
66+
# If the Autobuild fails above, remove it and uncomment the following three lines.
67+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
68+
69+
# - run: |
70+
# echo "Run, Build Application using script"
71+
# ./location_of_script_within_repo/buildscript.sh
72+
73+
- name: Perform CodeQL Analysis
74+
uses: github/codeql-action/analyze@v2
75+
with:
76+
category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-review.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging.
4+
#
5+
# Source repository: https://github.com/actions/dependency-review-action
6+
# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
7+
name: 'Dependency Review'
8+
on: [pull_request]
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
dependency-review:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: 'Checkout Repository'
18+
uses: actions/checkout@v3
19+
- name: 'Dependency Review'
20+
uses: actions/dependency-review-action@v2

‎.github/workflows/njsscan.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow integrates njsscan with GitHub's Code Scanning feature
7+
# nodejsscan is a static security code scanner that finds insecure code patterns in your Node.js applications
8+
9+
name: njsscan sarif
10+
11+
on:
12+
push:
13+
branches: [ "main" ]
14+
pull_request:
15+
# The branches below must be a subset of the branches above
16+
branches: [ "main" ]
17+
schedule:
18+
- cron: '17 17 * * 1'
19+
20+
permissions:
21+
contents: read
22+
23+
jobs:
24+
njsscan:
25+
permissions:
26+
contents: read # for actions/checkout to fetch code
27+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
28+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
29+
runs-on: ubuntu-latest
30+
name: njsscan code scanning
31+
steps:
32+
- name: Checkout the code
33+
uses: actions/checkout@v3
34+
- name: nodejsscan scan
35+
id: njsscan
36+
uses: ajinabraham/njsscan-action@7237412fdd36af517e2745077cedbf9d6900d711
37+
with:
38+
args: '. --sarif --output results.sarif || true'
39+
- name: Upload njsscan report
40+
uses: github/codeql-action/upload-sarif@v2
41+
with:
42+
sarif_file: results.sarif

‎.github/workflows/node.js.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# This workflow will do a clean installation of node dependencies, cache/restore them, build the source code and run tests across different versions of node
2+
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-nodejs
3+
4+
name: Node.js CI
5+
on:
6+
push:
7+
branches: [ "main" ]
8+
pull_request:
9+
branches: [ "main" ]
10+
jobs:
11+
build:
12+
runs-on: ubuntu-latest
13+
name: pnpm / install
14+
strategy:
15+
matrix:
16+
node-version: [16]
17+
steps:
18+
- uses: actions/checkout@v3
19+
- uses: pnpm/action-setup@v2
20+
with:
21+
version: 7
22+
- name: Use Node.js ${{ matrix.node-version }}
23+
uses: actions/setup-node@v3
24+
with:
25+
node-version: ${{ matrix.node-version }}
26+
cache: 'npm'
27+
- name: Install dependencies
28+
run: pnpm install
29+
lint-and-test:
30+
needs: build
31+
runs-on: ubuntu-latest
32+
steps:
33+
- name: Checkout code
34+
uses: actions/checkout@v2
35+
- name: Use Node.js
36+
uses: actions/setup-node@v2
37+
with:
38+
node-version: '16'
39+
- name: Install dependencies
40+
run: npm install
41+
- name: Run unit tests
42+
run: npm run test

0 commit comments

Comments
 (0)