continuous-integration.yml

# Workflow to performs continuous integration steps agains a Node.js project:
#
# - CodeQL analysis
# - Linting
# - Build
# - Test

name: Node.js Continuous Integration

on:
  workflow_call:
    inputs:
      runs-on:
        description: |
          JSON array of runner(s) to use.
          See https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job.
        type: string
        default: '["ubuntu-latest"]'
        required: false
      build:
        description: |
          Build parameters. Must be a string or a JSON object.
          For string, provide a list of commands to run during the build step, one per line.
          For JSON object, provide the following properties:

          - `commands`: Array of commands to run during the build step.
          - `env`: Object of environment variables to set during the build step.
          - `artifact`: String or array of strings specifying paths to artifacts to upload after the build

          Example:
          ```json
          {
            "commands": [
              "build",
              "generate-artifacts"
            ],
            "env": {
              "CUSTOM_ENV_VAR": "value"
            },
            "artifact": [
              "dist/",
              "packages/package-a/build/"
            ]
          }
          ```
        type: string
        required: false
        default: "build"
      checks:
        description: "Optional flag to enable check steps."
        type: boolean
        required: false
        default: true
      lint:
        description: "Optional flag to enable linting."
        type: boolean
        required: false
        default: true
      code-ql:
        description: "Code QL analysis language. See <https://github.com/github/codeql-action>."
        type: string
        required: false
        default: "typescript"
      dependency-review:
        description: "Enable dependency review scan. See <https://github.com/actions/dependency-review-action>."
        type: boolean
        required: false
        default: true
      test:
        description: "Optional flag to enable test."
        type: boolean
        required: false
        default: true
      coverage:
        description: "Specify code coverage reporter. Supported values: `codecov`."
        type: string
        required: false
        default: "codecov"
      working-directory:
        description: "Working directory where the dependencies are installed."
        type: string
        required: false
        default: "."
      container:
        description: "Docker container image to run CI steps in. When specified, steps will execute inside this container instead of checking out code. The container should have the project code and dependencies pre-installed."
        type: string
        required: false
        default: ""
    secrets:
      build-secrets:
        description: |
          Secrets to be used during the build step.
          Must be a multi-line env formatted string.
          Example:
          ```txt
          SECRET_EXAMPLE=$\{{ secrets.SECRET_EXAMPLE }}
          ```
        required: false
    outputs:
      build-artifact-id:
        description: "ID of the build artifact) uploaded during the build step."
        value: ${{ jobs.build.outputs.artifact-id }}

permissions: {}

jobs:
  code-ql:
    name: 🛡️ CodeQL Analysis
    if: inputs.checks == true && inputs.code-ql != ''
    permissions:
      security-events: write
    runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
    steps:
      - uses: hoverkraft-tech/ci-github-common/actions/checkout@5f11437c716059f30c635f90055060e4ef8b31a0 # 0.28.0
      - uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
        with:
          languages: ${{ inputs.code-ql }}
      - uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2

  dependency-review:
    name: 🛡️ Dependency Review
    if: github.event_name == 'pull_request' && inputs.checks == true && inputs.dependency-review
    permissions:
      contents: read
    runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
    steps:
      - uses: hoverkraft-tech/ci-github-common/actions/checkout@5f11437c716059f30c635f90055060e4ef8b31a0 # 0.28.0
      - uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1

  setup:
    name: ⚙️ Setup
    runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
    container:
      image: ${{ inputs.container != '' && inputs.container || null }}
      # Root user is required to use GitHub Actions features inside the container
      options: --user root:root
    permissions:
      contents: read
      # FIXME: This is a workaround for having workflow ref. See https://github.com/orgs/community/discussions/38659
      id-token: write
    outputs:
      build-env: ${{ steps.build-variables.outputs.env }}
      build-commands: ${{ steps.build-variables.outputs.commands }}
      build-artifact: ${{ steps.build-variables.outputs.artifact }}
    steps:
      - if: inputs.container == ''
        uses: hoverkraft-tech/ci-github-common/actions/checkout@5f11437c716059f30c635f90055060e4ef8b31a0 # 0.28.0

      - id: build-variables
        if: inputs.build != ''
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          WORKING_DIRECTORY: ${{ inputs.working-directory }}
          BUILD_INPUT: ${{ inputs.build }}
        with:
          script: |
            const fs = require('node:fs');
            const path = require('node:path');

            let workingDirectory = process.env.WORKING_DIRECTORY || '.';
            if (!path.isAbsolute(workingDirectory)) {
              workingDirectory = path.join(process.env.GITHUB_WORKSPACE, workingDirectory);
            }

            if (!fs.existsSync(workingDirectory)) {
              core.setFailed(`The specified working directory does not exist: ${workingDirectory}`);
              return;
            }

            const buildInput = process.env.BUILD_INPUT.trim();

            let commands = [];
            let env = {};

            // Build commands is a list of command(s), one per line.
            const buildCommandsIsList = !buildInput.trim().startsWith('{') && !buildInput.trim().startsWith('[');
            if (buildCommandsIsList) {
              commands = buildInput.split('\n').map(command => command.trim()).filter(Boolean);
            } else {
              let build;
              try {
                build = JSON.parse(buildInput);
              } catch (error) {
                core.setFailed(`Failed to parse build input as JSON: ${error.message}`);
                return;
              }

              // Build commands is a JSON array of commands
              if (Array.isArray(build)) {
                commands = build;
              }
              // Build commands is a JSON object
              else {
                commands = build.commands ?? ["build"];
                env = build.env ?? {};

                if (build.artifact) {
                  buildArtifact = build.artifact;

                  if (typeof buildArtifact === 'string' || Array.isArray(buildArtifact)) {
                    buildArtifact = {
                      paths: buildArtifact
                    };
                  }

                  if (typeof buildArtifact.paths === 'string') {
                    buildArtifact.paths = buildArtifact.paths.split('\n');
                  } else if (!Array.isArray(buildArtifact.paths)) {
                    return core.setFailed('Build artifact paths must be a string or an array of strings');
                  }

                  buildArtifact.paths = buildArtifact.paths
                    .map(artifact => artifact.trim())
                    .filter(Boolean)
                    .map(artifact => {
                      // FIXME: Workaround to preserve full path to artifact
                      const fullpath = artifact.startsWith('/') ? artifact : path.join(workingDirectory, artifact);

                      // Add a wildcard to the first folder of the path
                      return fullpath.replace(/\/([^/]+)/, '/*$1');
                    }).join('\n');

                  if (!buildArtifact.paths) {
                    return core.setFailed('No valid build artifact paths found');
                  }

                  // Generate a unique name for the artifact
                  buildArtifact.name = `${process.env.GITHUB_JOB}-build-${process.env.GITHUB_RUN_ID}-${Math.random().toString(36).substring(2, 8)}`;

                  core.setOutput('artifact', JSON.stringify(buildArtifact));
                }
              }
            }

            if (commands.some(command => typeof command !== 'string')) {
              core.setFailed('Build commands array must only contain strings');
              return;
            }

            const sanitizedCommands = commands.map(command => command.trim()).filter(Boolean);
            if (!sanitizedCommands.length) {
              core.setFailed('No build commands found');
            }

            core.setOutput('commands', sanitizedCommands.join('\n'));
            core.setOutput('env', JSON.stringify(env));

  lint:
    name: 👕 Lint
    if: inputs.checks == true && inputs.lint != false
    runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
    container:
      image: ${{ inputs.container != '' && inputs.container || null }}
      # Root user is required to use GitHub Actions features inside the container
      options: --user root:root
    needs: setup
    # jscpd:ignore-start
    permissions:
      contents: read
      # FIXME: This is a workaround for having workflow ref. See https://github.com/orgs/community/discussions/38659
      id-token: write
    steps:
      - uses: hoverkraft-tech/ci-github-common/actions/checkout@5f11437c716059f30c635f90055060e4ef8b31a0 # 0.28.0
        if: inputs.container == ''

      # FIXME: This is a workaround for having workflow ref. See https://github.com/orgs/community/discussions/38659
      - id: oidc
        uses: ChristopherHX/oidc@73eee1ff03fdfce10eda179f617131532209edbd # v3
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          path: ./self-workflow
          repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
          ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
          sparse-checkout: |
            actions
      - run: |
          if [ -f .gitignore ]; then grep -q "self-workflow" .gitignore || echo "self-workflow" >> .gitignore; else echo "self-workflow" >> .gitignore; fi
          if [ -f .dockerignore ]; then grep -q "self-workflow" .dockerignore || echo "self-workflow" >> .dockerignore; else echo "self-workflow" >> .dockerignore; fi

      - id: setup-node
        if: inputs.container == ''
        uses: ./self-workflow/actions/setup-node
        with:
          working-directory: ${{ inputs.working-directory }}
          dependencies-cache: |
            nx
            prettier

      - id: get-package-manager
        if: inputs.container
        uses: ./self-workflow/actions/get-package-manager
        with:
          working-directory: ${{ inputs.working-directory }}
      # jscpd:ignore-end

      - run: ${{ inputs.container && steps.get-package-manager.outputs.run-script-command || steps.setup-node.outputs.run-script-command }} lint
        working-directory: ${{ inputs.working-directory }}

  build:
    name: 🏗️ Build
    if: inputs.checks == true
    runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
    # jscpd:ignore-start
    container:
      image: ${{ inputs.container != '' && inputs.container || null }}
      # Root user is required to use GitHub Actions features inside the container
      options: --user root:root
    needs: setup
    permissions:
      contents: read
      # FIXME: This is a workaround for having workflow ref. See https://github.com/orgs/community/discussions/38659
      id-token: write
    outputs:
      artifact-id: ${{ steps.build-artifact-id.outputs.artifact-id }}
    steps:
      - uses: hoverkraft-tech/ci-github-common/actions/checkout@5f11437c716059f30c635f90055060e4ef8b31a0 # 0.28.0
        if: needs.setup.outputs.build-commands && inputs.container == ''

      # FIXME: This is a workaround for having workflow ref. See https://github.com/orgs/community/discussions/38659
      - id: oidc
        if: needs.setup.outputs.build-commands
        uses: ChristopherHX/oidc@73eee1ff03fdfce10eda179f617131532209edbd # v3
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        if: needs.setup.outputs.build-commands
        with:
          path: ./self-workflow
          repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
          ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
          sparse-checkout: |
            actions
      - if: needs.setup.outputs.build-commands
        run: |
          if [ -f .gitignore ]; then grep -q "self-workflow" .gitignore || echo "self-workflow" >> .gitignore; else echo "self-workflow" >> .gitignore; fi
          if [ -f .dockerignore ]; then grep -q "self-workflow" .dockerignore || echo "self-workflow" >> .dockerignore; else echo "self-workflow" >> .dockerignore; fi
      # jscpd:ignore-end
      - if: needs.setup.outputs.build-commands
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          BUILD_ENV: ${{ needs.setup.outputs.build-env }}
          BUILD_SECRETS: ${{ secrets.build-secrets }}
        with:
          script: |
            const envInput = process.env.BUILD_ENV || '{}';

            let buildEnv = {};

            try {
              buildEnv = JSON.parse(envInput);
            } catch (e) {
              core.setFailed(`Invalid build env JSON: ${e.message}`);
            }

            for (const [key, value] of Object.entries(buildEnv)) {
              core.exportVariable(key, value);
            }

            const secretsInput = process.env.BUILD_SECRETS || '';
            for (const line of secretsInput.split('\n').map(line => line.trim()).filter(Boolean)) {
              const [key, ...rest] = line.split('=');
              if (!key || !rest.length) {
                return core.setFailed(`Invalid build secrets format: ${line}`);
              }
              const value = rest.join('=');
              core.exportVariable(key.trim(), value.trim());
            }

      - id: setup-node
        if: needs.setup.outputs.build-commands && inputs.container == ''
        uses: ./self-workflow/actions/setup-node
        with:
          working-directory: ${{ inputs.working-directory }}
          dependencies-cache: |
            nx
            gatsby
            storybook

      - id: get-package-manager
        if: needs.setup.outputs.build-commands && inputs.container
        uses: ./self-workflow/actions/get-package-manager
        with:
          working-directory: ${{ inputs.working-directory }}

      - if: needs.setup.outputs.build-commands
        working-directory: ${{ inputs.working-directory }}
        env:
          BUILD_COMMANDS: ${{ needs.setup.outputs.build-commands }}
          RUN_SCRIPT_COMMAND: ${{ inputs.container && steps.get-package-manager.outputs.run-script-command || steps.setup-node.outputs.run-script-command }}
        run: |
          echo "$BUILD_COMMANDS" | while IFS= read -r COMMAND ; do
              # Trim whitespace
              COMMAND=$(echo "$COMMAND" | xargs)

              # Skip empty lines
              if [ -z "$COMMAND" ]; then
                  continue
              fi

              echo -e "\n - Running $COMMAND"
              $RUN_SCRIPT_COMMAND "$COMMAND"
          done

      - id: build-artifact-id
        if: needs.setup.outputs.build-commands && needs.setup.outputs.build-artifact
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: ${{ fromJSON(needs.setup.outputs.build-artifact).name }}
          path: ${{ fromJSON(needs.setup.outputs.build-artifact).paths }}
          if-no-files-found: error

  test:
    name: 🧪 Test
    if: inputs.checks == true && inputs.test == true
    runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
    container:
      image: ${{ inputs.container != '' && inputs.container || null }}
      # Root user is required to use GitHub Actions features inside the container
      options: --user root:root
    needs:
      - setup
      - build
    permissions:
      contents: read
      # FIXME: This is a workaround for having workflow ref. See https://github.com/orgs/community/discussions/38659
      id-token: write
    steps:
      - uses: hoverkraft-tech/ci-github-common/actions/checkout@5f11437c716059f30c635f90055060e4ef8b31a0 # 0.28.0
        if: inputs.container == ''

      - if: needs.build.outputs.artifact-id && inputs.container == ''
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          artifact-ids: ${{ needs.build.outputs.artifact-id }}
          path: "/"

      # FIXME: This is a workaround for having workflow ref. See https://github.com/orgs/community/discussions/38659
      - id: oidc
        uses: ChristopherHX/oidc@73eee1ff03fdfce10eda179f617131532209edbd # v3
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          path: ./self-workflow
          repository: ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
          ref: ${{ steps.oidc.outputs.job_workflow_repo_ref }}
          sparse-checkout: |
            actions
      - run: |
          if [ -f .gitignore ]; then grep -q "self-workflow" .gitignore || echo "self-workflow" >> .gitignore; else echo "self-workflow" >> .gitignore; fi
          if [ -f .dockerignore ]; then grep -q "self-workflow" .dockerignore || echo "self-workflow" >> .dockerignore; else echo "self-workflow" >> .dockerignore; fi

      - id: setup-node
        if: inputs.container == ''
        uses: ./self-workflow/actions/setup-node
        with:
          working-directory: ${{ inputs.working-directory }}
          dependencies-cache: |
            nx
            jest

      - id: get-package-manager
        if: needs.setup.outputs.build-commands && inputs.container
        uses: ./self-workflow/actions/get-package-manager
        with:
          working-directory: ${{ inputs.working-directory }}

      - run: ${{ inputs.container && steps.get-package-manager.outputs.run-script-command || steps.setup-node.outputs.run-script-command }} test:ci
        working-directory: ${{ inputs.working-directory }}
        env:
          CI: "true"

      - if: inputs.coverage == 'codecov' && inputs.container
        env:
          REQUIRED_DEPS: |
            git
            curl
            gpg
        run: |
          apt-get update
          for dep in $REQUIRED_DEPS; do
            if ! dpkg -s "$dep" >/dev/null 2>&1; then
              apt-get install -y "$dep"
            fi
          done

      - name: 📊 Code coverage
        if: inputs.coverage == 'codecov'
        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
        with:
          use_oidc: true
          disable_telem: true