code-quality.yml

name: "Check code format and quality"

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, ready_for_review, synchronize, reopened]

permissions:
  checks: write
  contents: read
  pull-requests: write
  statuses: write

jobs:
  check-code-quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Check text files format
        run: |
          build/automation/etc/githooks/scripts/editorconfig-pre-commit.sh

      - name: Markdown Format Check
        run: |
          build/automation/etc/githooks/scripts/markdown-pre-commit.sh

      - name: GitHub Actions - Check best practices
        run: |
          make github-actions-best-practices

      - name: Kubernetes - Check best practices
        run: |
          make kubernetes-best-practices

      - name: Docker - Check best practices
        run: |
          make docker-best-practices

  python-check-code-quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v4
        with:
          python-version: "3.10"
          cache: "pip"

      - name: Ruff Check
        uses: jpetrucciani/ruff-check@main
        with:
          path: "."

      - name: Python Dead Code Check
        run: |
          make python-dead-code-install python-dead-code-check

  typescript-check-code-quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v3
        with:
          node-version: 18
          cache: "yarn"
          cache-dependency-path: application/ui

      - name: Cache node modules
        uses: actions/cache@v3
        with:
          path: ~/.yarn
          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
          restore-keys: |
            ${{ runner.os }}-yarn-

      - name: Test Setup
        run: make typescript-unit-test-ci-setup

      - name: Typescript Check Package
        run: |
          make typescript-package-duplicate-check

      - name: Typescript Code Format and Quality
        run: |
          make typescript-check-format typescript-check-lint

  terraform-check-code-quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Check Terraform files format
        run: |
          build/automation/etc/githooks/scripts/terraform-format-pre-commit.sh

      - name: Checkov Terraform Best Practices
        run: |
          make terraform-best-practices

      - name: TFSec Terraform Security Scanning
        run: |
          make terraform-security

  sonarcloud-analysis:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v3
        with:
          node-version: 18
          cache: "yarn"
          cache-dependency-path: application/ui

      - name: Cache node modules
        uses: actions/cache@v3
        with:
          path: ~/.yarn
          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
          restore-keys: |
            ${{ runner.os }}-yarn-

      - name: Test Setup
        run: make typescript-unit-test-ci-setup

      - name: Run Typescript Unit Tests
        run: make typescript-unit-test

      - uses: actions/setup-python@v4
        with:
          python-version: "3.10"
          cache: "pip"
          cache-dependency-path: |
            application/requirements-dev.txt
            application/*/requirements.txt

      - name: Cache Python dependencies
        uses: actions/cache@v3
        id: cache-python-dependencies
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
          restore-keys: |
            ${{ runner.os }}-pip-

      - name: Python Install Requirements
        run: make pip-install

      - name: Run Python Unit Tests
        run: make python-unit-test

      - uses: sonarsource/sonarcloud-github-action@master
        # SEE: https://github.com/SonarSource/sonarcloud-github-action
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          projectBaseDir: .
          args: >
            -Dsonar.sources=application,deployment,infrastructure,build/docker,scripts
            -Dsonar.organization=nhsd-exeter
            -Dsonar.projectKey=uec-dos-ct
            -Dsonar.coverage.exclusions=**/__test__/**,deployment,infrastructure,scripts/**.py,application/ui/src/index.tsx,application/ui/jest.config.js,application/ui/craco.config.js,application/ui/src/reportWebVitals.ts,application/ui/src/setupTests.ts,application/conftest.py,application/*/tests/**.py
            -Dsonar.javascript.lcov.reportPaths=application/ui/coverage/lcov.info
            -Dsonar.python.coverage.reportPaths=coverage.xml
            -Dsonar.python.version=3.10
            -Dsonar.terraform.provider.aws.version=4.66.0
            -Dsonar.tests=test