on-code-change.yml

# This workflow is triggered every time a change is pushed to any open PR (or when the PR is created)
# Github actions command reference: https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions
# Our GitHub Action is available here: https://github.com/Jahia/jahia-modules-action
name: On Code Change

# The workflow is only triggered on changes done in a PR.
on:
  pull_request:
    types: [opened, reopened, synchronize]

jobs:
  static-analysis:
    name: Static Analysis (linting, vulns)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Jahia/jahia-modules-action/static-analysis@v2
        with:
          # In some situations it might be necessary to specify a particular version of node
          # node_version: 12
          auditci_level: critical

  build:
    name: Build Module
    runs-on: ubuntu-latest
    env:
      NEXUS_INTERNAL_URL: https://devtools.jahia.com/nexus/content/groups/internal/
    container:
      image: jahia/cimg-mvn-cache:ga_cimg_openjdk_11.0.20-node
      credentials:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_PASSWORD }}
    steps:
      - uses: actions/checkout@v4
      - uses: jahia/jahia-modules-action/build@v2
        with:
          module_id: html-filtering
          nexus_username: ${{ secrets.NEXUS_USERNAME }}
          nexus_password: ${{ secrets.NEXUS_PASSWORD }}

  integration-tests:
    name: Integration Tests
    needs: build
    # Use self-hosted if you want to run on our own runners
    # you would typically want to use self-hosted runners for integration tests
    runs-on: self-hosted
    # Timeout is important as it forces the job to fail if it hangs for any reason,
    # If not specified it will be left running until workflow run limit is reached (72h)
    timeout-minutes: 45
    steps:
      # The helper is used to print instructions, such as how to connect to the runner.
      # It should be defined as a workflow step (vs a step in an action itself) since some
      # annotations are only posted upon completion of the step (i.e. you'd only see
      # the connection instructions annotation posted once the integration tests are done)
      - uses: jahia/jahia-modules-action/helper@v2
      - uses: actions/checkout@v4
      - uses: KengoTODA/actions-setup-docker-compose@main
        with:
          version: '2.23.0'
      - uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
      - uses: jahia/jahia-modules-action/integration-tests@v2
        with:
          module_id: html-filtering
          testrail_project: HTML Filtering Module
          tests_manifest: provisioning-manifest-build.yml
          jahia_image: jahia/jahia-discovery-dev:8-SNAPSHOT
          should_use_build_artifacts: true
          github_artifact_name: html-filtering-artifacts-${{ github.run_number }}
          bastion_ssh_private_key: ${{ secrets.BASTION_SSH_PRIVATE_KEY_JAHIACI }}
          jahia_license: ${{ secrets.JAHIA_LICENSE_8X_FULL }}
          docker_username: ${{ secrets.DOCKERHUB_USERNAME }}
          docker_password: ${{ secrets.DOCKERHUB_PASSWORD }}
          nexus_username: ${{ secrets.NEXUS_USERNAME }}
          nexus_password: ${{ secrets.NEXUS_PASSWORD }}
          # Test report is useful when posting annotation if multiple similar jobs are performed
          # For example, there could be one report for standalone and one report for cluster test
          # It is not needed if there is only one type of integration tests within the workflow
          tests_report_name: Test report (Standalone)
          testrail_username: ${{ secrets.TESTRAIL_USERNAME }}
          testrail_password: ${{ secrets.TESTRAIL_PASSWORD }}
          incident_pagerduty_api_key: ${{ secrets.INCIDENT_PAGERDUTY_API_KEY }}
          incident_pagerduty_reporter_email: ${{ secrets.INCIDENT_PAGERDUTY_REPORTER_EMAIL }}
          incident_pagerduty_reporter_id: ${{ secrets.INCIDENT_PAGERDUTY_REPORTER_ID }}
          incident_google_spreadsheet_id: ${{ secrets.INCIDENT_GOOGLE_SPREADSHEET_ID }}
          incident_google_client_email: ${{ secrets.INCIDENT_GOOGLE_CLIENT_EMAIL }}
          incident_google_api_key_base64: ${{ secrets.INCIDENT_GOOGLE_API_KEY_BASE64 }}
          zencrepes_secret: ${{ secrets.ZENCREPES_WEBHOOK_SECRET }}
      - name: Test Report
        uses: phoenix-actions/test-reporting@v12
        if: success() || failure()
        with:
          name: Tests Report
          path: tests/artifacts/results/xml_reports/**/*.xml
          reporter: java-junit
          fail-on-error: 'false'
          output-to: 'checks'

  sonar-analysis:
    name: Sonar Analysis
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: jahia/jahia-modules-action/sonar-analysis@v2
        with:
          # If the primary release branch is other than "main", specify it here
          # primary_release_branch: master
          github_pr_id: ${{github.event.number}}
          sonar_url: ${{ secrets.SONAR_URL }}
          sonar_token: ${{ secrets.SONAR_TOKEN }}
          nvd_apikey: ${{ secrets.NVD_APIKEY }}