melinda-node-tests.yml

# Melinda node tests

name: Melinda node tests

on: push

jobs:
  build-node-versions:
    name: Node version matrix
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [18.x, 19.x, 20.x]
        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/

    steps:
    - name: Checkout the code
      uses: actions/checkout@v4
    - name: Use Node.js ${{ matrix.node-version }}
      uses: actions/setup-node@v4
      with:
        node-version: ${{ matrix.node-version }}
        cache: 'npm'
      env:
        NPM_CONFIG_IGNORE_SCRIPTS: true
    - run: npm audit --package-lock-only --production --audit-level=high
    - run: npm ci
    - run: npm test
    - run: npm run build --if-present

  license-scan:
    name: License compliance check
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - uses: mikaelvesavuori/license-compliance-action@v1.0.3
        with:
          exclude_pattern: /^@natlibfi/

  njsscan:
    name: Njsscan check
    runs-on: ubuntu-latest

    steps:
    - name: Checkout the code
      uses: actions/checkout@v4
    - name: nodejsscan scan
      id: njsscan
      uses: ajinabraham/njsscan-action@master
      with:
        args: '.'

  quayio:
    name: Quay.io image builder & publisher
    needs: [build-node-versions, njsscan]
    runs-on: ubuntu-latest
    if: github.actor!= 'dependabot[bot]'   # ignore the pull request which comes from user dependabot, because it does not access to secrets

    steps:
      - uses: actions/checkout@v4
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: quay.io/${{ github.repository }}
          tags: |
            type=raw,value=latest,enable=${{ endsWith(github.ref, github.event.repository.default_branch) }}
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
      - name: Login to Quay.io
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ secrets.MELINDA_QUAY_IO_USERNAME }}
          password: ${{ secrets.MELINDA_QUAY_IO_PASSWORD }}
      - name: Build and publish image to Quay.io
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}

  openshift-webhook:
    name: OpenShift webhook for image builder
    needs: [build-node-versions, njsscan]
    runs-on: ubuntu-latest

    steps:
      - name: Production auth names webhook
        uses: joelwmale/webhook-action@master
        if: github.ref == 'refs/heads/master'
        with:
          url: ${{ secrets.WEBHOOK_URL_AUTH_PROD }}
          body: '{}'
      - name: Production bib webhook
        uses: joelwmale/webhook-action@master
        if: github.ref == 'refs/heads/master'
        with:
          url: ${{ secrets.WEBHOOK_URL_BIB_PROD_FROM_MASTER }}
          body: '{}'
      - name: Test aut aux webhook
        uses: joelwmale/webhook-action@master
        if: github.ref == 'refs/heads/test'
        with:
          url: ${{ secrets.WEBHOOK_URL_AUT_AUX_TEST_FROM_TEST }}
          body: '{}'
      - name: Test aut names webhook
        uses: joelwmale/webhook-action@master
        if: github.ref == 'refs/heads/test'
        with:
          url: ${{ secrets.WEBHOOK_URL_AUT_NAMES_TEST_FROM_TEST }}
          body: '{}'
      - name: Test aut subjects webhook
        uses: joelwmale/webhook-action@master
        if: github.ref == 'refs/heads/test'
        with:
          url: ${{ secrets.WEBHOOK_URL_AUT_SUBJECTS_TEST_FROM_TEST }}
          body: '{}'
      - name: Test aut works webhook
        uses: joelwmale/webhook-action@master
        if: github.ref == 'refs/heads/test'
        with:
          url: ${{ secrets.WEBHOOK_URL_AUT_WORKS_TEST_FROM_TEST }}
          body: '{}'
      - name: Test bib webhook
        uses: joelwmale/webhook-action@master
        if: github.ref == 'refs/heads/test'
        with:
          url: ${{ secrets.WEBHOOK_URL_BIB_TEST_FROM_TEST }}
          body: '{}'