pr-checks.yml

name: Run PR checks
run-name: "Running checks for PR #${{ github.event.pull_request.number }} (${{ github.event.pull_request.title }})"

on:
  pull_request:
    types: [opened, reopened, synchronize]

jobs:
  build:
    name: Build and test
    runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
    environment: pull-request
    permissions:
      contents: read
      actions: write

    steps:
      - name: Git clone - ${{ github.ref }}
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}

      - name: Setup environment
        run: |
          echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
          poetry install --no-root

      - name: Lint
        run: make lint

      - name: Build
        run: make build

      - name: Test
        run: make test

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-artifacts
          path: dist

  sonar:
    name: SonarQube scan
    runs-on: ubuntu-latest
    needs: build
    environment: pull-request
    permissions:
      contents: read
      actions: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}

      - name: Get build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-artifacts
          path: dist

      - name: SonarQube scan
        uses: sonarsource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 #v7.0.0
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      - name: SonarQube quality gate check
        id: sonarqube-quality-gate-check
        uses: sonarsource/sonarqube-quality-gate-action@cf038b0e0cdecfa9e56c198bbb7d21d751d62c3b #v1.2.0
        with:
          pollingTimeoutSec: 600
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}