attack-workbench-rest-api/.github/workflows/ci.yml at main · mitre-attack/attack-workbench-rest-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
name: CI and Release

on:
  push:
    branches:
      - main
      - next
      - next-major
      - beta
      - alpha
      - '*.x'     # Matches branches like '1.x', '2.x'
  pull_request: # Run on all PRs regardless of target branch
  workflow_dispatch:

permissions:
  contents: read

jobs:
  # Job 1: Commit Linting
  commitlint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Fetch full history to check commit differences

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22.x'

      - name: Install dependencies
        run: npm ci

      - name: Validate all commits
        run: npx commitlint --from ${{ github.event.pull_request.base.sha || github.event.before }} --to ${{ github.event.pull_request.head.sha || github.sha }} --verbose

  # Job 2: Static Checks (Linting, Security Scanning)
  static-checks:
    needs: [commitlint]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22.x'

      - name: Install dependencies
        run: npm ci

      - name: Run linting
        run: npm run lint

  # Job 3: Regression Tests
  regression-tests:
    runs-on: ubuntu-latest
    needs: [static-checks]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22.x'

      - name: Install dependencies
        run: npm ci

      - name: Run regression tests with code coverage
        run: npm run coverage:cobertura
        env:
          MONGOSTORE_CRYPTO_SECRET: 'ThisisASecretKeyForTestingPurposesOnly1234567890!@#$'

      - name: Upload Coverage to CodeCov
        uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_SECRET }}
          files: coverage/cobertura-coverage.xml
          verbose: true

      - name: Upload coverage reports as artifact
        uses: actions/upload-artifact@v4
        with:
          name: coverage-reports
          path: coverage/
          retention-days: 7

      - name: Verify integrity of dependencies
        run: npm audit signatures

  # Job 4: Semantic Release and Docker Build
  release:
    needs: [regression-tests]
    # Only run on pushes (not PRs) - semantic-release will determine whether to release
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: write         # To publish a GitHub release
      packages: write         # To publish to GitHub Package registry
      issues: write           # To comment on released issues
      pull-requests: write    # To comment on released pull requests
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22.x'

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          install: true # Sets up docker build command as an alias to docker buildx
          driver-opts: image=moby/buildkit:latest
          platforms: linux/amd64,linux/arm64

      - name: Install dependencies
        run: npm ci

      - name: Semantic Release
        id: semantic
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # needed to authenticate with @codedependant/semantic-release-docker
          DOCKER_REGISTRY_USER: ${{ github.repository_owner }}
          DOCKER_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          # Temporarily disables all Git hooks
          HUSKY: 0
        run: npx semantic-release