stage-1-commit.yaml

name: "Commit stage"

on:
  workflow_call:
    inputs:
      build_datetime:
        description: "Build datetime, set by the CI/CD pipeline workflow"
        required: true
        type: string
      build_timestamp:
        description: "Build timestamp, set by the CI/CD pipeline workflow"
        required: true
        type: string
      build_epoch:
        description: "Build epoch, set by the CI/CD pipeline workflow"
        required: true
        type: string
      nodejs_version:
        description: "Node.js version, set by the CI/CD pipeline workflow"
        required: true
        type: string
      python_version:
        description: "Python version, set by the CI/CD pipeline workflow"
        required: true
        type: string
      terraform_version:
        description: "Terraform version, set by the CI/CD pipeline workflow"
        required: true
        type: string
      version:
        description: "Version of the software, set by the CI/CD pipeline workflow"
        required: true
        type: string

jobs:
  scan-secrets:
    name: "Scan secrets"
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Full history is needed to scan all commits
      - name: "Scan secrets"
        uses: ./.github/actions/scan-secrets
  check-file-format:
    name: "Check file format"
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Full history is needed to compare branches
      - name: "Check file format"
        uses: ./.github/actions/check-file-format
  check-markdown-format:
    name: "Check Markdown format"
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Full history is needed to compare branches
      - name: "Check Markdown format"
        uses: ./.github/actions/check-markdown-format
  terraform-docs:
    name: "Run terraform-docs"
    runs-on: ubuntu-latest
    needs: detect-terraform-changes
    if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
    permissions:
        contents: write
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Full history is needed to compare branches
      - name: "Check to see if Terraform Docs are up-to-date"
        run: |
          make terraform-docs
      - name: "Stage changes"
        run: |
          git add infrastructure/terraform/**/*.md
      - name: "Check for changes in Terraform Docs"
        run: |
          if git diff --cached --name-only | grep -qE '\.md$'; then
            echo "Markdown files have changed. Please run 'make terraform-docs' and commit the changes."
            exit 1
          fi
  check-english-usage:
    name: "Check English usage"
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Full history is needed to compare branches
      - name: "Check English usage"
        uses: ./.github/actions/check-english-usage
  detect-terraform-changes:
    name: "Detect Terraform Changes"
    runs-on: ubuntu-latest
    outputs:
      terraform_changed: ${{ steps.check.outputs.terraform_changed }}
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4

      - name: "Check for Terraform changes"
        id: check
        run: |
          git fetch origin main || true  # Ensure you have the latest main branch
          CHANGED_FILES=$(git diff --name-only HEAD origin/main)
          echo "Changed files: $CHANGED_FILES"

          if echo "$CHANGED_FILES" | grep -qE '\.tf$'; then
            echo "Terraform files have changed."
            echo "terraform_changed=true" >> $GITHUB_OUTPUT
          else
            echo "No Terraform changes detected."
            echo "terraform_changed=false" >> $GITHUB_OUTPUT
          fi
  lint-terraform:
    name: "Lint Terraform"
    runs-on: ubuntu-latest
    timeout-minutes: 2
    needs: detect-terraform-changes
    if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4
      - name: "Lint Terraform"
        uses: ./.github/actions/lint-terraform
  tfsec:
    name: "TFSec Scan"
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs: detect-terraform-changes
    if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4
      - name: "Setup ASDF"
        uses: asdf-vm/actions/setup@v3
      - name: "Perform Setup"
        uses: ./.github/actions/setup
      - name: "TFSec Scan"
        uses: ./.github/actions/tfsec
  count-lines-of-code:
    name: "Count lines of code"
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    timeout-minutes: 2
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4
      - name: "Count lines of code"
        uses: ./.github/actions/create-lines-of-code-report
        with:
          build_datetime: "${{ inputs.build_datetime }}"
          build_timestamp: "${{ inputs.build_timestamp }}"
          idp_aws_report_upload_account_id: "${{ secrets.IDP_AWS_REPORT_UPLOAD_ACCOUNT_ID }}"
          idp_aws_report_upload_region: "${{ secrets.IDP_AWS_REPORT_UPLOAD_REGION }}"
          idp_aws_report_upload_role_name: "${{ secrets.IDP_AWS_REPORT_UPLOAD_ROLE_NAME }}"
          idp_aws_report_upload_bucket_endpoint: "${{ secrets.IDP_AWS_REPORT_UPLOAD_BUCKET_ENDPOINT }}"
  scan-dependencies:
    name: "Scan dependencies"
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    timeout-minutes: 2
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4
      - name: "Scan dependencies"
        uses: ./.github/actions/scan-dependencies
        with:
          build_datetime: "${{ inputs.build_datetime }}"
          build_timestamp: "${{ inputs.build_timestamp }}"
          idp_aws_report_upload_account_id: "${{ secrets.IDP_AWS_REPORT_UPLOAD_ACCOUNT_ID }}"
          idp_aws_report_upload_region: "${{ secrets.IDP_AWS_REPORT_UPLOAD_REGION }}"
          idp_aws_report_upload_role_name: "${{ secrets.IDP_AWS_REPORT_UPLOAD_ROLE_NAME }}"
          idp_aws_report_upload_bucket_endpoint: "${{ secrets.IDP_AWS_REPORT_UPLOAD_BUCKET_ENDPOINT }}"