terraform-aws-metrics-lambda/.github/workflows/pull-request.yml at develop · NHSDigital/terraform-aws-metrics-lambda · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
name: pull-request
on:
  workflow_dispatch:
  pull_request:
    branches:
      - develop

concurrency:
  group: ${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:

  lint:
    runs-on: ubuntu-latest

    steps:

      - name: checkout the calling repo
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: build-common
        uses: ./.github/actions/build-common

      - name: tflint --init
        if: ${{ hashFiles('.tflint.hcl') }}
        run: |
          tflint --init
        shell: bash

      - name: lint
        shell: bash
        run: |
          make lint-ci

  test:
    runs-on: ubuntu-latest
    permissions:
      checks: write
      pull-requests: write
    steps:

      - name: checkout the calling repo
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: build-common
        uses: ./.github/actions/build-common

      - name: run tests
        shell: bash
        run: |
          make coverage-ci

      - name: coverage comment
        if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' && hashFiles('./reports/coverage.xml') && hashFiles('./reports/pytest-coverage.txt') }}
        uses: MishaKav/pytest-coverage-comment@e48ae95fa406cefacc7fbdd79949122795569961
        with:
          pytest-coverage-path: ./reports/pytest-coverage.txt
          pytest-xml-coverage-path: ./reports/coverage.xml
          junitxml-path: ./reports/junit/results.xml

      - name: convert sonar reports
        if: ${{ hashFiles('./reports/junit/*.xml') || hashFiles('./reports/coverage.xml') }}
        uses: ./.github/actions/sonar-reports

      - name: prepare sonar properties
        if: ${{ hashFiles('./sonar-project.properties') }}
        uses: ./.github/actions/sonar-properties

      - name: sonarqube scan
        uses: SonarSource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      - name: publish test report
        uses: mikepenz/action-junit-report@d9f48fc87bc235f7e214acf696ca5abc0a986f16
        if: ${{ !cancelled() }}
        with:
          report_paths: 'reports/junit/*.xml'
          require_tests: true
          fail_on_failure: true

  dependabot:
    if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'NHSDigital/terraform-aws-metrics-lambda'
    needs:
      - lint
      - test
    permissions:
      contents: write
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - name: verify dependabot commits
        uses: actions/github-script@v9
        with:
          script: |
            const commits = await github.rest.pulls.listCommits({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.issue.number
            })

            for (const commit of commits.data) {
              let author = commit.author;
              if (author.login != 'dependabot[bot]' || author.type != 'Bot') {
                throw new Error(`auto-merge-dependabot not permitted for author login: ${author.login} type: ${author.type}`);
              }

            }

            if (commits.data.length>249) {
              // api returns max 250 commits
              throw new Error("too many commits to verify commiter");
            }

      - name: Approve pull request
        uses: actions/github-script@v9
        with:
          script: |
            github.rest.pulls.createReview({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.issue.number,
              event: 'APPROVE'
            })

      - name: Merge pull request
        uses: actions/github-script@v9
        with:
          script: |
            github.rest.pulls.merge({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.issue.number,
              merge_method: 'merge'
            })