code_checks.yml

name: Code Checks
on:
  push:
    branches: [master]
  pull_request:
    types: [opened, reopened, synchronize]
permissions:
  id-token: write
  contents: read
  checks: write
jobs:
  compare_sha:
    runs-on: ubuntu-latest
    name: Compare sha
    steps:
      - name: Compare commit ids
        run: |
          echo "github.sha: ${{ github.sha }}"
          echo "github.event.push.head_commit.id: ${{ github.event.push.head_commit.id }}"
          echo "github.event.pull_request.merge_commit_sha: ${{ github.event.pull_request.merge_commit_sha }}"
          echo "github.event.head_commit.id: ${{ github.event.head_commit.id }}"

  linting_and_security:
    name: Linting and Security
    env:
      BUNDLE_ENTERPRISE__CONTRIBSYS__COM: ${{ secrets.BUNDLE_ENTERPRISE__CONTRIBSYS__COM }}
    permissions: write-all
    runs-on: ubuntu-32-cores-latest
    steps:
      - name: Checkout PR
        if: ${{ github.event_name != 'pull_request' }}
        uses: actions/checkout@v4

      - name: Checkout PR HEAD ref
        if: ${{ github.event_name == 'pull_request' }}
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0

      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - name: Run bundle-audit (checks gems for CVE issues)
        run: bundle exec bundle-audit check --update --ignore CVE-2024-27456

      - name: Run Rubocop
        run: bundle exec rubocop --parallel --format github

      - name: Run Brakeman
        run: bundle exec brakeman --ensure-latest --confidence-level=2 --format github

      # Always add the "lint-failure" label on failure and remove it on success
      - name: Add Lint Failure label
        if: ${{ failure() && github.event_name == 'pull_request' }}
        uses: actions-ecosystem/action-add-labels@v1
        with:
          number: ${{ github.event.pull_request.number }}
          labels: lint-failure

      - name: Remove Lint Failure label
        if: ${{ success() && github.event_name == 'pull_request' }}
        uses: actions-ecosystem/action-remove-labels@v1
        with:
          number: ${{ github.event.pull_request.number }}
          labels: lint-failure

  tests:
    name: Test
    runs-on: ubuntu-32-cores-latest
    permissions: write-all
    env:
      BUNDLE_ENTERPRISE__CONTRIBSYS__COM: ${{ secrets.BUNDLE_ENTERPRISE__CONTRIBSYS__COM }}
      ECR_REGISTRY_WITH_SLASH: "${{ secrets.ECR_REGISTRY }}/"
      CI: true
      RAILS_ENV: test
      TERM: xterm-256color
      DOCKER_BUILDKIT: 1
      COMPOSE_DOCKER_CLI_BUILD: 1
      COMPOSE_BASH_CMD: docker compose -f docker-compose.test.yml run web bash -c
    steps:
      - name: Checkout PR
        if: ${{ github.event_name != 'pull_request' }}
        uses: actions/checkout@v4

      - name: Checkout PR HEAD ref
        if: ${{ github.event_name == 'pull_request' }}
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USER }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4.0.2
        with:
          role-to-assume: ${{ vars.AWS_ASSUME_ROLE }}
          aws-region: us-gov-west-1

      - name: Login to Amazon ECR
        id: ecr-login
        uses: aws-actions/amazon-ecr-login@v2.0.1
        with:
          mask-password: true

      - name: Set Environment Variable
        run: echo "VETS_API_USER_ID=$(id -u)" >> $GITHUB_ENV

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Docker Image
        uses: docker/build-push-action@v6
        env:
          DOCKER_BUILD_SUMMARY: false
        with:
          build-args: |
            BUNDLE_ENTERPRISE__CONTRIBSYS__COM=${{ env.BUNDLE_ENTERPRISE__CONTRIBSYS__COM }}
            USER_ID=${{ env.VETS_API_USER_ID }}
          context: .
          push: false
          load: true
          tags: vets-api
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Setup Database
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
          timeout_minutes: 10
          retry_wait_seconds: 3 # Seconds
          max_attempts: 3
          command: >
            ${{ env.COMPOSE_BASH_CMD }}
            "bundle exec rake parallel:setup[24]"

      - name: Setup system tmp dir
        run: >
          ${{ env.COMPOSE_BASH_CMD }}
          "mkdir -p tmp/systmp"

      - name: Run Specs
        timeout-minutes: 15
        run: >
          ${{ env.COMPOSE_BASH_CMD }}
          "TMPDIR=tmp/systmp bundle exec rake 'parallel:spec[24, , , modules\/]'"

      - name: Upload Coverage Report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: Coverage Report
          path: coverage
          include-hidden-files: true

      - name: Upload Test Results (JUnit XMLs)
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: Test Results
          path: log/*.xml
          if-no-files-found: ignore

      - name: Upload Test Artifacts (log)
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: Test Artifacts (log directory)
          path: |
            log
            !log/*.xml
          if-no-files-found: ignore

      - name: Upload Test Artifacts (rails tmp)
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: Test Artifacts (rails tmp directory)
          path: tmp
          if-no-files-found: ignore
          retention-days: 14

      - name: Remove Test Failure label
        if: ${{ success() && github.event_name == 'pull_request' }}
        uses: actions-ecosystem/action-remove-labels@v1
        with:
          number: ${{ github.event.pull_request.number }}
          labels: test-failure

      - name: Add Test Failure label
        if: ${{ failure() && github.event_name == 'pull_request' }}
        uses: actions-ecosystem/action-add-labels@v1
        with:
          number: ${{ github.event.pull_request.number }}
          labels: test-failure

  publish_results:
    name: Publish Test Results and Coverage
    if: always()
    needs: tests
    permissions: write-all
    runs-on: ubuntu-16-cores-latest

    steps:
      - uses: actions/download-artifact@v4

      - name: Publish Test Results to GitHub
        if: always()
        uses: EnricoMi/publish-unit-test-result-action@v2
        with:
          check_name: Test Results
          comment_mode: off
          files: Test Results/*.xml
          github_token: ${{ secrets.GITHUB_TOKEN }}

      - name: Fix up coverage report to work with coverage-check-action
        run: sed -i 's/"line"/"covered_percent"/g' 'Coverage Report/.last_run.json'

      - name: Publish Coverage Report
        if: ${{ hashFiles('Coverage Report/.last_run.json') != '' }}
        uses: devmasx/coverage-check-action@v1.2.0
        with:
          type: simplecov
          result_path: Coverage Report/.last_run.json
          min_coverage: 90
          token: ${{ secrets.GITHUB_TOKEN }}