nodejs.yml

name: Build

on: [push]

jobs:

  # -- TESTS ------------------------------------------------------------------
  tests:
    name: Tests
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node: ['18']

    steps:
      - name: Harden GitHub Actions Runner
        uses: step-security/harden-runner@97689868c8aca5a4bcd16ab96bbda25a0efb734b
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            api.github.com:443
            pipelines.actions.githubusercontent.com:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
            nodejs.org:443
            snyk.io:443

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - name: Setup Node.js ${{ matrix.node }}
        uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
        with:
          node-version: ${{ matrix.node }}
          check-latest: true

      - name: Install dependencies
        run: npm install

      - name: Copy Playlists & Inventory examples
        run: |
          cp -R src/examples/playlists config/playlists
          cp src/examples/inventory.json config/inventory.json

      - name: Run Unit-Tests + Code Coverage
        run: npm run test:coverage

      - name: Save Code Coverage
        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          name: code-coverage
          path: coverage

  # -- SONARCLOUD -------------------------------------------------------------
  code-quality:
    name: Code Quality
    runs-on: ubuntu-latest
    needs: tests

    steps:
      - name: Harden GitHub Actions Runner
        uses: step-security/harden-runner@97689868c8aca5a4bcd16ab96bbda25a0efb734b
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            api.github.com:443
            pipelines.actions.githubusercontent.com:443
            sonarcloud.io:443
            scanner.sonarcloud.io:443

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - name: Download Code Coverage
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
        with:
          name: code-coverage
          path: coverage

      - name: Get App Version
        run: ./scripts/version.sh

      - name: SonarCloud Scan
        uses: sonarsource/sonarcloud-github-action@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  # functional-tests:
  #   runs-on: ubuntu-latest
  #   needs: tests

  #   steps:
  #     - name: Harden GitHub Actions Runner
  #       uses: step-security/harden-runner@248ae51c2e8cc9622ecf50685c8bf7150c6e88
  #         with:
  #         egress-policy: audit

  #     - name: Checkout
  #       uses: actions/checkout@v2

  #     - name: Build docker image
  #       run: docker build -t timoa/chrome-tab-rotate-server .

  #     - name: Start Docker container
  #       run: docker-compose up -d

  #     - name: Check Docker container status
  #       run: docker ps -a

  #     - name: Install dependencies
  #       run: npm install

  #     - name: Run Functional tests
  #       run: npm run test:functional

  #     - name: Stop Docker container
  #       run: docker-compose down

  # -- SAST SCAN --------------------------------------------------------------
  code-security:
    name: Code Security
    runs-on: ubuntu-latest
    needs: tests
    # Skip any PR created by dependabot to avoid permission issues
    if: (github.actor != 'dependabot[bot]')

    steps:
      - name: Harden GitHub Actions Runner
        uses: step-security/harden-runner@97689868c8aca5a4bcd16ab96bbda25a0efb734b
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            api.github.com:443
            pipelines.actions.githubusercontent.com:443
            registry.npmjs.org:443
            pypi.org:443
            osv-vulnerabilities.storage.googleapis.com:443
            nvd.nist.gov:443
            docker.io:443
            registry-1.docker.io:443
            auth.docker.io:443
            production.cloudflare.docker.com:443

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - name: Perform Scan
        uses: ShiftLeftSecurity/scan-action@master

        env:
          WORKSPACE: https://github.com/${{ github.repository }}/blob/${{ github.sha }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SCAN_ANNOTATE_PR: true

      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          name: reports
          path: reports

  # -- API TESTS --------------------------------------------------------------
  api-tests:
    name: API Tests
    runs-on: ubuntu-latest
    needs: tests

    strategy:
      matrix:
        node: ['18']

    steps:
      - name: Harden GitHub Actions Runner
        uses: step-security/harden-runner@97689868c8aca5a4bcd16ab96bbda25a0efb734b
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - name: Setup Node.js ${{ matrix.node }}
        uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
        with:
          node-version: ${{ matrix.node }}
          check-latest: true

      - name: Install dependencies
        run: npm install

      - name: Copy Playlists & Inventory examples
        run: |
          cp -R src/examples/playlists config/playlists
          cp src/examples/inventory.json config/inventory.json

      - name: Install Postman Newman
        run: npm install newman

      - name: Start the app
        run: npm start > /dev/null &

      - name: Run Postman Newman
        run: node_modules/.bin/newman run https://api.getpostman.com/collections/${{ secrets.POSTMAN_COLLECTION }}?apikey=${{ secrets.POSTMAN_API_TOKEN }} -e https://api.getpostman.com/environments/${{ secrets.POSTMAN_ENVIRONMENT }}?apikey=${{ secrets.POSTMAN_API_TOKEN }}

  # -- ZAP Scan ---------------------------------------------------------------
  api-security:
    name: API Security
    runs-on: ubuntu-latest
    needs: tests
    # Skip any PR created by dependabot to avoid permission issues
    if: (github.actor != 'dependabot[bot]')

    strategy:
      matrix:
        node: ['18']

    steps:
      - name: Harden GitHub Actions Runner
        uses: step-security/harden-runner@97689868c8aca5a4bcd16ab96bbda25a0efb734b
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - name: Setup Node.js ${{ matrix.node }}
        uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
        with:
          node-version: ${{ matrix.node }}
          check-latest: true

      - name: Install dependencies
        run: npm install

      - name: Copy Playlists & Inventory examples
        run: |
          cp -R src/examples/playlists config/playlists
          cp src/examples/inventory.json config/inventory.json

      - name: Start the app
        run: npm start > /dev/null &

      - name: Run ZAP Scan
        uses: zaproxy/action-full-scan@994be0395c128170ba970e8443c222517f9f614d # v0.5.1
        with:
          target: http://localhost:9000

  # -- PRE-RELEASE ------------------------------------------------------------
  pre-release:
    name: Prepare Release
    runs-on: ubuntu-latest
    needs:
      - code-quality
      - code-security
      - api-security
    if: github.ref == 'refs/heads/master'

    steps:
      - name: Harden GitHub Actions Runner
        uses: step-security/harden-runner@97689868c8aca5a4bcd16ab96bbda25a0efb734b
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - name: Semantic Release
        uses: cycjimmy/semantic-release-action@8e58d20d0f6c8773181f43eb74d6a05e3099571d # v3.4.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # -- BUILD ------------------------------------------------------------------
  build:
    name: Build & Release
    runs-on: ubuntu-latest
    needs: pre-release
    if: github.ref == 'refs/heads/master'

    steps:
      - name: Harden GitHub Actions Runner
        uses: step-security/harden-runner@97689868c8aca5a4bcd16ab96bbda25a0efb734b
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 0

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0
        with:
          images: ${{ github.repository }}
          tags: |
            type=ref,event=branch
            type=match,pattern=v(.*),group=1
            type=raw,value=latest

      - name: Set up QEMU
        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1

      - name: Login to DockerHub
        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push
        uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6 # v3.3.1
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}