Skip to content

fix: hide QAQC data from anon and BCeID users #317

fix: hide QAQC data from anon and BCeID users

fix: hide QAQC data from anon and BCeID users #317

Workflow file for this run

name: Analysis
on:
push:
branches: [main]
pull_request:
types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
schedule:
- cron: "0 11 * * 0" # 3 AM PST = 12 PM UDT, runs sundays
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
# tests:
# name: Tests
# if: ${{ ! github.event.pull_request.draft }}
# runs-on: ubuntu-latest
# timeout-minutes: 5
# services:
# postgres:
# image: postgres
# env:
# POSTGRES_PASSWORD: postgres
# options: >-
# --health-cmd pg_isready
# --health-interval 10s
# --health-timeout 5s
# --health-retries 5
# ports:
# - 5432:5432
# strategy:
# matrix:
# dir: [backend, frontend]
# include:
# - dir: backend
# token: SONAR_TOKEN_BACKEND
# - dir: frontend
# token: SONAR_TOKEN_FRONTEND
# steps:
# - uses: bcgov-nr/[email protected]
# with:
# commands: |
# npm ci
# npm run test:cov
# dir: ${{ matrix.dir }}
# node_version: "22"
# sonar_args: >
# -Dsonar.exclusions=**/coverage/**,**/node_modules/**,**/*spec.ts
# -Dsonar.organization=bcgov-sonarcloud
# -Dsonar.projectKey=quickstart-openshift_${{ matrix.dir }}
# -Dsonar.sources=src
# -Dsonar.tests.inclusions=**/*spec.ts
# -Dsonar.javascript.lcov.reportPaths=./coverage/lcov.info
# sonar_token: ${{ secrets[matrix.token] }}
# triggers: ('${{ matrix.dir }}/')
# https://github.com/marketplace/actions/aqua-security-trivy
trivy:
name: Trivy Security Scan
if: ${{ ! github.event.pull_request.draft }}
runs-on: ubuntu-latest
timeout-minutes: 1
steps:
- uses: actions/checkout@v4
- name: Run Trivy vulnerability scanner in repo mode
uses: aquasecurity/[email protected]
with:
format: "sarif"
output: "trivy-results.sarif"
ignore-unfixed: true
scan-type: "fs"
scanners: "vuln,secret,config"
severity: "CRITICAL,HIGH"
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: "trivy-results.sarif"
results:
name: Analysis Results
# needs: [tests, trivy]
needs: [trivy]
if: always()
runs-on: ubuntu-latest
steps:
- if: contains(needs.*.result, 'failure')
run: echo "At least one job has failed." && exit 1
- run: echo "Success!"