unit-tests.yml

name: Unit Tests and Analysis

on:
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
      - ready_for_review
  push:
    branches:
      - main
    paths-ignore:
      - "**.md"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  #TODO: check sonar for OG
  tests-backend:
    name: Backend Unit Tests
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    continue-on-error: true
    runs-on: ubuntu-22.04
    steps:
      - name: Test app
        uses: bcgov-nr/action-test-and-analyse@v1.1.0
        with:
          commands: |
            npm ci
            npm run test:cov
          dir: backend
          node_version: 16
          sonar_args: >
            -Dsonar.exclusions=**/coverage/**,**/examples/**,**/pages/**
            -Dsonar.organization=bcgov-sonarcloud
            -Dsonar.projectKey=forest-client-frontend
            -Dsonar.tests=test
          sonar_token: ${{ secrets.SONAR_TOKEN_BACKEND }}

      - name: Report code coverage
        uses: zgosalvez/github-actions-report-lcov@v3
        with:
          coverage-files: coverage/lcov.info
          minimum-coverage: 75
          artifact-name: code-coverage-report
          github-token: ${{ secrets.GITHUB_TOKEN }}
          working-directory: ./backend
          update-comment: true

  trivy:
    name: Repository Report
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@0.14.0
        with:
          scan-type: "fs"
          format: "sarif"
          output: "trivy-results.sarif"
          ignore-unfixed: true
          severity: "CRITICAL,HIGH"
          security-checks: "vuln,secret,config"

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: "trivy-results.sarif"