Merge pull request #813 from govuk-one-login/oj-1495-sonarcloud-workf…

…lows

OJ-1495: Add SonarCloud workflows

.github/workflows/check-pr.yml

@@ -0,0 +1,17 @@
+name: Check PR
+
+on: pull_request
+permissions: {}
+
+jobs:
+  code-quality:
+    name: Code quality
+    uses: ./.github/workflows/code-quality.yml
+
+  unit-tests:
+    name: Run tests
+    uses: ./.github/workflows/run-unit-tests.yml
+
+  browser-tests:
+    name: Run tests
+    uses: ./.github/workflows/run-browser-tests.yml

.github/workflows/code-quality.yml

@@ -0,0 +1,35 @@
+name: Code quality
+
+on: workflow_call
+permissions: {}
+
+concurrency:
+  group: code-quality-${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  pre-commit:
+    name: pre-commit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run pre-commit
+        uses: govuk-one-login/github-actions/code-quality/run-pre-commit@145049ebd9a33e57da9a852847c4ee2c8970ea51
+        with:
+          install-dependencies: true
+          package-manager: yarn
+          all-files: true
+
+  translation-checks:
+    name: i18n
+    runs-on: ubuntu-latest
+    steps:
+      - name: Translation checks
+        uses: govuk-one-login/github-actions/env/run-script@145049ebd9a33e57da9a852847c4ee2c8970ea51
+        with:
+          node-version: 18.x
+          package-manager: yarn
+          script: yarn run check-translation

.github/workflows/run-browser-tests.yml

@@ -0,0 +1,25 @@
+name: Browser tests
+
+on: workflow_call
+
+concurrency:
+  group: browser-tests-${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+permissions: {}
+
+jobs:
+  run-tests:
+    name: Browser
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run tests
+        uses: govuk-one-login/github-actions/env/run-script@145049ebd9a33e57da9a852847c4ee2c8970ea51
+        with:
+          node-version: 18.x
+          package-manager: yarn
+          script: yarn run test:browser:ci

.github/workflows/run-unit-tests.yml

@@ -0,0 +1,40 @@
+name: Unit tests
+
+on:
+  workflow_call:
+    inputs:
+      coverage-report: { type: boolean, required: false, default: false }
+      coverage-artifact: { type: string, required: false, default: coverage }
+    outputs:
+      coverage-artifact:
+        value: ${{ inputs.coverage-artifact }}
+
+concurrency:
+  group: unit-tests-${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+permissions: {}
+
+jobs:
+  run-tests:
+    name: Unit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run tests
+        uses: govuk-one-login/github-actions/env/run-script@145049ebd9a33e57da9a852847c4ee2c8970ea51
+        with:
+          node-version: 18.x
+          package-manager: yarn
+          script: yarn run test:coverage
+
+      - name: Archive coverage results
+        if: ${{ inputs.coverage-report }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: ${{ inputs.coverage-artifact }}
+          retention-days: 3
+          path: reports/coverage/lcov.info

.github/workflows/scan-repo.yml

@@ -0,0 +1,45 @@
+name: Scan repository
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    # Every Monday at 9am
+    - cron: "0 9 * * 1"
+
+concurrency:
+  group: scan-repo-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+permissions: read-all
+
+jobs:
+  unit-tests:
+    name: Test coverage
+    uses: ./.github/workflows/run-unit-tests.yml
+    with:
+      coverage-report: true
+
+  sonarcloud:
+    name: SonarCloud
+    needs: unit-tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run SonarCloud scan
+        uses: govuk-one-login/github-actions/code-quality/sonarcloud@145049ebd9a33e57da9a852847c4ee2c8970ea51
+        with:
+          coverage-artifact: ${{ needs.unit-tests.outputs.coverage-artifact }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sonar-token: ${{ secrets.SONAR_TOKEN }}
+
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Run CodeQL scan
+        uses: govuk-one-login/github-actions/code-quality/codeql@145049ebd9a33e57da9a852847c4ee2c8970ea51
+        with:
+          languages: javascript