actions-dev-kit/.github/workflows/actions-dev-kit-ci.yml at 9ceda8d7d2f51c39768fc6343cfe8bcb7bc063aa · aws/actions-dev-kit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# This is a CI workflow that:
# - builds ADK packages
# - runs tests using jest test framework
# - runs api-ref scripts that generates API Reference docs to the docs/ folder
# - runs api-ref-pre-release scripts that generates API Reference docs to the pre-release-docs/ folder
# - runs generate-attributions that generates third party license attributions files
# - performs secrets scan using trufflesecurity/trufflehog GHA
# - performs vulnerabilities scan using returntocorp/semgrep GHA

name: adk-ci

on:
  workflow_dispatch:
  pull_request:
    branches: [main, gamma]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # Target branch of the pull request
          # Source https://docs.github.com/en/actions/learn-github-actions/contexts#github-context
          ref: ${{ github.base_ref }}
      - uses: actions/setup-node@v4
        with:
          node-version: 16
      - run: npm install --global lerna yarn #install global dependencies
      - run: yarn install #install and link depdendencies
      - run: ./build.sh #build
      - run: yarn run api-ref #test generate /docs
      - run: yarn run api-ref-pre-release #test generate /pre-release-docs
      - run: yarn run generate-attributions #test generate ./<package>/THIRD_PARTY_LICENSES

  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: TruffleHog OSS
        uses: trufflesecurity/trufflehog@v3.63.8
        with:
          path: ./
          # Target branch of the pull request
          # Source https://docs.github.com/en/actions/learn-github-actions/contexts#github-context
          base: ${{ github.base_ref }}
          head: HEAD
          extra_args: --debug

  semgrep:
    runs-on: ubuntu-latest

    container:
      image: returntocorp/semgrep

    if: (github.actor != 'dependabot[bot]')

    steps:
      - uses: actions/checkout@v4
        with:
          # Target branch of the pull request
          # Source https://docs.github.com/en/actions/learn-github-actions/contexts#github-context
          ref: ${{ github.base_ref }}
      - run: semgrep ci --include packages
        env:
          SEMGREP_RULES: "p/default"