fix(deps): update all non-major frontend dependencies #6012
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pipeline | |
| on: | |
| # run on any branch receiving a push (not only on main) | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| # also: allow to run this workflow manually | |
| workflow_dispatch: | |
| jobs: | |
| ############################################# | |
| # jobs dispatched to a separate workflow file | |
| ############################################# | |
| backend-jobs: | |
| permissions: | |
| security-events: write # upload-sarif | |
| packages: write | |
| id-token: write | |
| contents: read | |
| uses: ./.github/workflows/backend-jobs.yml | |
| with: | |
| container-registry: ghcr.io | |
| container-image-name: ${{ github.repository }} | |
| container-image-version: ${{ github.event.pull_request.head.sha || github.sha }} | |
| secrets: inherit # e.g. sonar token | |
| frontend-jobs: | |
| permissions: | |
| security-events: write # upload-sarif | |
| packages: write | |
| id-token: write | |
| contents: read | |
| uses: ./.github/workflows/frontend-jobs.yml | |
| with: | |
| # It would be nicer if we used the env vars defined above (as not to duplicate information), | |
| # however, env vars cannot be passed over to a reuseable workflow using "with" | |
| # cf. https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations | |
| # and the workaround is horrible | |
| # cf. https://docs.github.com/en/actions/using-workflows/reusing-workflows#using-outputs-from-a-reusable-workflow | |
| container-registry: ghcr.io | |
| container-image-name: ${{ github.repository }} | |
| container-image-version: ${{ github.event.pull_request.head.sha || github.sha }} | |
| secrets: inherit # e.g. sonar token | |
| ldml-extension-jobs: | |
| uses: ./.github/workflows/ldml-extension-jobs.yml | |
| secrets: inherit # e.g. sonar token | |
| create-docker-image-job: | |
| permissions: | |
| security-events: write # upload-sarif | |
| packages: write | |
| id-token: write | |
| contents: read | |
| uses: ./.github/workflows/create-docker-image-job.yml | |
| with: | |
| container-registry: ghcr.io | |
| container-image-name: ${{ github.repository }} | |
| container-image-version: ${{ github.event.pull_request.head.sha || github.sha }} | |
| secrets: inherit # e.g. sonar token | |
| push-docker-image-job: | |
| if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'dev-env') || contains(github.event.labeled.labels.*.name, 'dev-env') }} | |
| needs: | |
| - backend-jobs | |
| - frontend-jobs | |
| - create-docker-image-job | |
| - e2e-tests | |
| permissions: | |
| security-events: write # upload-sarif | |
| packages: write | |
| id-token: write | |
| contents: read | |
| uses: ./.github/workflows/push-docker-image-job.yml | |
| with: | |
| container-registry: ghcr.io | |
| container-image-name: ${{ github.repository }} | |
| container-image-version: ${{ github.event.pull_request.head.sha || github.sha }} | |
| secrets: inherit # e.g. sonar token | |
| # ###################### | |
| # # Check time for automatic deployments | |
| # # Should only deploy automatically outside the hours when migration/publishing jobs run | |
| # ###################### | |
| check-auto-deploy: | |
| if: ${{ github.ref == 'refs/heads/main' }} | |
| runs-on: ubuntu-latest | |
| outputs: | |
| should-auto-deploy: ${{ steps.check-time.outputs.should-auto-deploy }} | |
| steps: | |
| - id: check-time | |
| run: | | |
| current_hour=$(TZ=UTC date "+%H") | |
| if [ "$current_hour" -ge 2 ] && [ "$current_hour" -lt 6 ]; then | |
| echo "Should not deploy automatically. Current hour is $current_hour" | |
| echo "should-auto-deploy=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "Should deploy automatically. Current hour is $current_hour" | |
| echo "should-auto-deploy=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| # ###################### | |
| # # Deploy new versions to staging | |
| # ###################### | |
| deploy-staging-job: | |
| if: ${{ github.ref == 'refs/heads/main' && needs.check-auto-deploy.outputs.should-auto-deploy == 'true' }} | |
| needs: | |
| - check-auto-deploy | |
| - frontend-jobs | |
| - backend-jobs | |
| - push-docker-image-job | |
| - e2e-tests | |
| permissions: | |
| id-token: write | |
| uses: ./.github/workflows/deploy-staging-job.yml | |
| secrets: inherit | |
| # ###################### | |
| # # Deploy new versions to uat | |
| # ###################### | |
| deploy-uat-job: | |
| if: ${{ github.ref == 'refs/heads/main' }} | |
| needs: | |
| - deploy-staging-job | |
| permissions: | |
| id-token: write | |
| uses: ./.github/workflows/deploy-uat-job.yml | |
| secrets: inherit | |
| # ######################## | |
| # # system test jobs | |
| # ######################## | |
| e2e-tests: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| browser: [chromium, firefox, msedge] | |
| uses: ./.github/workflows/end-to-end-tests.yml | |
| with: | |
| browser: ${{ matrix.browser }} | |
| secrets: inherit | |
| ################ | |
| # Security jobs | |
| ################ | |
| trivy-scan: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # upload-sarif | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Run Trivy vulnerability scanner in repo mode | |
| uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 | |
| env: | |
| ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db | |
| TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db | |
| with: | |
| scan-type: "fs" | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| severity: "CRITICAL,HIGH" #ignored by sarif report | |
| - name: Check trivy results | |
| run: | | |
| if grep -qE 'HIGH|CRITICAL' trivy-results.sarif; then | |
| echo "Vulnerabilities found" | |
| exit 1 | |
| else | |
| echo "No significant vulnerabilities found" | |
| exit 0 | |
| fi | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| if: ${{ always() && github.ref == 'refs/heads/main' }} # Bypass non-zero exit code.. | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| - name: Send status to Slack | |
| # Third-party action, pin to commit SHA! | |
| # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions | |
| uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0 | |
| if: ${{ failure() && github.ref == 'refs/heads/main' }} | |
| with: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} | |
| talisman-check: | |
| runs-on: ubuntu-latest | |
| # Running on main only https://digitalservicebund.slack.com/archives/C046VD44ZEH/p1706516240974409 | |
| if: ${{ github.ref == 'refs/heads/main' }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Detect secrets in incoming commits with Talisman | |
| uses: digitalservicebund/talisman-secrets-scan-action@9a4cb85589e29a62b4546eb566119753a5680aeb | |
| - name: Send status to Slack | |
| # only on failure and if on "main" branch | |
| if: ${{ failure() && github.ref == 'refs/heads/main' }} | |
| uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0 | |
| with: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} | |
| ################### | |
| # Generate reports | |
| ################### | |
| generate-test-reports: | |
| if: ${{ !cancelled() && github.ref == 'refs/heads/main' }} | |
| needs: | |
| - e2e-tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: ./frontend/.node-version | |
| cache: npm | |
| cache-dependency-path: ./frontend/package-lock.json | |
| - name: Cache node_modules | |
| uses: actions/cache@v4 | |
| id: cache-npm-cache | |
| with: | |
| # The docs discourage caching `node-modules`, cf. https://github.com/actions/cache/blob/main/examples.md#node---npm | |
| path: /home/runner/.npm | |
| key: npm-cache-${{ hashFiles('./frontend/package-lock.json') }} | |
| - name: Install node modules | |
| run: npm ci | |
| working-directory: ./frontend | |
| - name: Download blob reports from artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: ./frontend/all-blob-reports | |
| pattern: test-results-blob-* | |
| - name: Prepare test reports for merge | |
| working-directory: ./frontend/all-blob-reports | |
| run: | | |
| for DIR in test-results-blob-*; do | |
| unzip -o "$DIR/test-report.zip" -d "$DIR" | |
| rm "$DIR/test-report.zip" | |
| ZIP_FILE="../$(basename "$DIR").zip" | |
| (cd "$DIR" && zip -r "$ZIP_FILE" ./*.jsonl) | |
| rm -rf "$DIR" | |
| done | |
| shell: bash | |
| - name: Merge into html report | |
| run: npx playwright merge-reports --reporter html ./all-blob-reports | |
| working-directory: ./frontend | |
| - name: Upload html report to artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: html-test-report | |
| path: ./frontend/playwright-report | |
| push-reports: | |
| runs-on: ubuntu-latest | |
| env: | |
| reports-repo: digitalservicebund/ris-reports | |
| needs: | |
| - generate-test-reports | |
| - backend-jobs | |
| if: ${{ github.ref == 'refs/heads/main' }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: ${{ env.reports-repo }} | |
| ssh-key: ${{ secrets.REPORTS_DEPLOY_KEY }} | |
| - name: Setup git config | |
| run: | | |
| git config user.name "${{ github.repository }}" | |
| # This email identifies the commit as GitHub Actions - see https://github.com/orgs/community/discussions/26560 | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| # Backend code documentation | |
| - name: Backend Code Documentation - Download | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: backend-code-documentation | |
| path: tmp/backend-code-documentation/ | |
| - name: Java - git add report | |
| uses: digitalservicebund/add-ris-report@c6c8735d23295c36a271c75e7dedc9b6b9a9ef5e | |
| with: | |
| filePath: tmp/backend-code-documentation | |
| destinationDir: norms-code-documentation/java | |
| reportIsDirectory: true | |
| # e2e test report | |
| - name: E2E test reports - Download | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: html-test-report | |
| path: tmp/html-test-report/ | |
| - name: E2E test reports - git add report | |
| uses: digitalservicebund/add-ris-report@c6c8735d23295c36a271c75e7dedc9b6b9a9ef5e | |
| with: | |
| filePath: tmp/html-test-report/ | |
| destinationDir: test-reports/ris-norms | |
| reportIsDirectory: true | |
| # Licence reports | |
| - name: Licence reports - Download | |
| uses: actions/download-artifact@v4 | |
| with: | |
| pattern: licence-reports-* | |
| path: tmp/licence-reports/ | |
| merge-multiple: true | |
| - name: Frontend licence report - git add report | |
| uses: digitalservicebund/add-ris-report@c6c8735d23295c36a271c75e7dedc9b6b9a9ef5e | |
| with: | |
| filePath: tmp/licence-reports/frontend-licence-report.csv | |
| destinationDir: licence-reports/frontend/ris-norms | |
| - name: Backend licence report - git add report | |
| uses: digitalservicebund/add-ris-report@c6c8735d23295c36a271c75e7dedc9b6b9a9ef5e | |
| with: | |
| filePath: tmp/licence-reports/backend-licence-report.csv | |
| destinationDir: licence-reports/backend/ris-norms | |
| # Push reports | |
| - name: Push reports | |
| run: | | |
| git diff-index --cached --quiet HEAD || | |
| git commit \ | |
| -m ${{ toJSON(github.event.head_commit.message) }} \ | |
| -m "From commit: ${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}" && | |
| git push origin main && | |
| echo "Pushed reports to ${{ github.server_url }}/${{ env.reports-repo }}" >> $GITHUB_STEP_SUMMARY | |
| - name: Send status to Slack | |
| uses: digitalservicebund/notify-on-failure-gha@66c485757701f8d5dbee32f24df38d904ca693ba | |
| if: ${{ failure() && github.ref == 'refs/heads/main' }} | |
| with: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} |