Skip to content

fix: sonar issues

fix: sonar issues #489

Workflow file for this run

name: Analysis
on:
pull_request:
paths-ignore:
- "*.md"
- "docker-compose.yml"
- "renovate.json"
- "COMPLIANCE.yaml"
- ".gitignore"
- ".vscode/**"
- ".diagrams/**"
- ".graphics/**"
- "sysdig/**"
- ".github/workflows/sysdig.yml"
types:
- opened
- reopened
- synchronize
- ready_for_review
push:
paths-ignore:
- "*.md"
- "docker-compose.yml"
- "renovate.json"
- "COMPLIANCE.yaml"
- ".gitignore"
- ".vscode/**"
- ".diagrams/**"
- ".graphics/**"
- "sysdig/**"
- ".github/workflows/sysdig.yml"
branches:
- main
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
tests:
name: Unit Tests
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
runs-on: ubuntu-22.04
environment: unit-test
env:
PUBLIC_KEY: |
${{ secrets.PUBLIC_KEY }}
PRIVATE_KEY: |
${{ secrets.PRIVATE_KEY }}
services:
postgres:
image: postgres
env:
POSTGRES_DB: postgres
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
ports:
- 5432:5432
strategy:
matrix:
dir: [backend, frontend, doc-gen-service, backend-external]
include:
- dir: backend
sonar_projectKey: fin-pay-transparency_backend
token: SONAR_TOKEN_BACKEND
- dir: frontend
sonar_projectKey: fin-pay-transparency_frontend
token: SONAR_TOKEN_FRONTEND
- dir: doc-gen-service
sonar_projectKey: fin-pay-transparency_doc-gen-service
token: SONAR_TOKEN_DOC_GEN_SERVICE
- dir: backend-external
sonar_projectKey: fin-pay-transparency_backend-external
token: SONAR_TOKEN_BACKEND_EXTERNAL
steps:
- uses: bcgov-nr/[email protected]
with:
commands: |
npm ci
npm run test:cov
dir: ${{ matrix.dir }}
node_version: "20"
sonar_args: >
-Dsonar.exclusions=**/coverage/**,**/node_modules/**,**/*spec.ts,**/dist/**,**/ches/**,**/templates/**
-Dsonar.organization=bcgov-sonarcloud
-Dsonar.project.monorepo.enabled=true
-Dsonar.projectKey=${{ matrix.sonar_projectKey }}
-Dsonar.sources=src
-Dsonar.tests.inclusions=**/*spec.ts
-Dsonar.javascript.lcov.reportPaths=./coverage/lcov.info
sonar_token: ${{ secrets[matrix.token] }}
triggers: ${{ matrix.triggers }}
codeql:
name: CodeQL Security Scan
if: ${{ ! github.event.pull_request.draft }}
runs-on: ubuntu-22.04
timeout-minutes: 5
steps:
- uses: actions/checkout@v4
- uses: github/codeql-action/init@v3
with:
languages: javascript
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: "/language:javascript"
# https://github.com/marketplace/actions/aqua-security-trivy
trivy:
name: Trivy Security Scan
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v4
- name: Run Trivy vulnerability scanner in repo mode
uses: aquasecurity/[email protected]
with:
format: "sarif"
output: "trivy-results.sarif"
ignore-unfixed: true
scan-type: "fs"
scanners: "vuln,secret,config"
severity: "CRITICAL,HIGH"
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: "trivy-results.sarif"
results:
name: Analysis Results
needs: [tests, codeql, trivy]
runs-on: ubuntu-22.04
steps:
- run: echo "Workflow completed successfully!"