ci.yml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - "**"

permissions: read-all

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  continuous-integration:
    name: Standard NodeJS checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node 20.x
        uses: actions/setup-node@v4
        with:
          node-version: "20.x"
          cache: "yarn"

      - name: Install Node dependencies
        run: yarn install --frozen-lockfile

      - name: Check uncommitted formatting changes
        run: yarn prettier . --check

      - name: Check for linting errors
        run: yarn lint

      - name: Typecheck
        run: yarn typecheck

      - name: Test
        run: yarn test --ci

  deployment-check:
    name: Check deployment artifacts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node 20.x
        uses: actions/setup-node@v4
        with:
          node-version: "20.x"
          cache: "yarn"

      - name: Install Node dependencies for deployment
        run: yarn install --production
        env:
          HUSKY: 0

      - name: Synthesize CloudFormation template and assets
        run: yarn synth

      - name: Check synthesized CloudFormation template with Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: cdk.out
          framework: cloudformation

      - name: Check Github Actions configuration with Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: .github
          framework: github_actions

  shell-check:
    name: Check shell scripts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: ludeeus/action-shellcheck@2.0.0
        with:
          ignore_paths: >-
            .husky/_
            node_modules