ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main

env:
  NODE_VERSION: 18
  AWS_ACCOUNT_DEVOPS: ${{ secrets.ECR_AWS_ACCOUNT_ID }}
  AWS_ROLE: GithubActions
  AWS_REGION: ${{ secrets.ECR_AWS_REGION }}

jobs:
  build:
    name: 👷 Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          cache: 'yarn'
          node-version-file: .nvmrc
          cache-dependency-path: '**/yarn.lock'
      - name: Install dependencies
        run: yarn install
        env:
          CI: true
      - name: Building
        run: yarn build

  lint:
    name: 🪥 Lint & Format
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          cache: 'yarn'
          node-version-file: .nvmrc
          cache-dependency-path: '**/yarn.lock'
      - name: Install dependencies
        run: yarn install
        env:
          CI: true
      - name: Checking format
        run: |
          yarn format-check
      - name: Checking lint
        run: |
          yarn lint

  testing:
    name: 👔 Test & Coverage
    runs-on: ubuntu-latest
    permissions:
      checks: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          cache: 'yarn'
          node-version-file: .nvmrc
          cache-dependency-path: '**/yarn.lock'
      - name: Install dependencies
        run: yarn install
        env:
          CI: true
      - name: Testing
        run: yarn run test
      - name: Coverage check
        uses: devmasx/coverage-check-action@v1.2.0
        with:
          type: lcov
          min_coverage: 77
          result_path: coverage/lcov.info
          token: ${{ github.token }}

  license-validation:
    name: 🪪 License Validation
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          cache: 'yarn'
          node-version-file: .nvmrc
          cache-dependency-path: '**/yarn.lock'
          registry-url: https://npm.pkg.github.com/
      - name: Install dependencies
        run: yarn install
        env:
          CI: true
          NODE_AUTH_TOKEN: ${{ secrets.CI_NPM_READ_ORG }}
      - name: License validation
        shell: bash
        run: ./thirdPartyLicenseCollector_linux_amd64 -npm-project .

  pack:
    name: 📦 Pack and Upload
    runs-on: ubuntu-latest
    needs:
      - build
      - lint
      - license-validation
    permissions:
      packages: write
      contents: read
      id-token: write
    env:
      IMAGE_NAME: auth-hosting
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Create docker ignore
        run: |
          cp .gitignore .dockerignore
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@8c3f20df09ac63af7b3ae3d7c91f105f857d8497 # v4
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_DEVOPS }}:role/${{ env.AWS_ROLE }}
          role-session-name: ${{ env.IMAGE_NAME }}-${{ github.run_number }}@${{ github.run_attempt }}
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
      - name: Extract metadata for the Docker image
        id: meta
        uses: descope/.github/.github/actions/docker/metadata@main
        with:
          images: |
            ghcr.io/descope/${{ env.IMAGE_NAME }}
            ${{ steps.login-ecr.outputs.registry }}/descope/${{ env.IMAGE_NAME }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          platforms: linux/amd64
          context: .
          push: true
          build-args: |
            NODE_VERSION=${{ env.NODE_VERSION }}
            NODE_AUTH_TOKEN=${{ secrets.CI_NPM_READ_ORG }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: |
            ${{ steps.meta.outputs.labels }}
            org.opencontainers.image.description=${{ steps.meta.outputs.description}}
          outputs: type=image,name=target,annotation-index.org.opencontainers.image.description=${{ steps.meta.outputs.description}},annotation-index.github.sha=${{github.sha}}