Skip to content

change order

change order #463

name: Code Review
on:
pull_request:
branches: ['main']
push:
jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Setup Node
uses: actions/setup-node@v3
with:
node-version: '18'
cache: 'yarn'
- name: Check dep dupes
run: yarn ci-dupe-check
- name: Install dependencies
run: yarn ci
- name: Build
run: yarn build
semgrep:
name: Code Scan
runs-on: ubuntu-latest
container:
image: returntocorp/semgrep
steps:
- name: Checkout code
uses: actions/checkout@v3
- run: semgrep ci --exclude 'public/charting_library'
env:
SEMGREP_RULES: p/typescript
sca:
name: Dependency Scan
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
# Report all vulnerabilities in CI output
- name: Report on all vulnerabilities
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
ignore-unfixed: true
hide-progress: true
format: 'table'
# Fail the job on critical vulnerabiliies with fix available
- name: Fail on critical vulnerabilities
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
ignore-unfixed: true
hide-progress: true
security-checks: 'vuln' # disable secrets scanning until public
format: 'table'
severity: 'CRITICAL'
exit-code: '1'