pull-request-check.yaml

name: "pull request check"

on:
  pull_request:
    types: [opened, reopened, edited, synchronize]
permissions:
  contents: write
  id-token: write # required to use OIDC authentication

jobs:
  semantic-validate:
    name: semantic-validate
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: amannn/action-semantic-pull-request@v5.0.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with :
          types: |
           feat
           fix
           docs
           refactor
           test
           build
           chore
           revert
          subjectPattern: ^[\s\w-\./]{5,100}$
          subjectPatternError: |
            The subject "{subject}" found in the pull request title "{title}"
            didn't match the configured pattern. Please ensure that the subject
            1) contains only alphanumeric characters,'_','-',' '.
            2) length between 5 and 100.
          requireScope: false
  pyflakes:
    needs: semantic-validate
    runs-on: ubuntu-latest
    permissions:
      checks: write
      contents: read
      pull-requests: read
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: pyflakes
        uses: reviewdog/action-pyflakes@master
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          reporter: github-pr-review
          level: error
  # git-secrets:
  #   needs: semantic-validate
  #   runs-on: ubuntu-latest
  #   steps:
  #     - uses: actions/checkout@v3
  #       with:
  #         submodules: recursive
  #     - name: Checkout awslabs/git-secrets
  #       uses: actions/checkout@v3
  #       with:
  #         submodules: recursive
  #         repository: awslabs/git-secrets
  #         ref: master
  #         path: git-secrets
  #     - name: Install git-secrets
  #       run: cd git-secrets && sudo make install && cd ..
  #     - name: Run git-secrets
  #       run: |
  #         git-secrets --register-aws
  #         git secrets --add --allowed 'source/constructs/lib/common/constants.ts'
  #         git-secrets --scan 

  # opensource-license-review:
  #   needs: semantic-validate
  #   runs-on: ubuntu-latest
  #   steps:
  #     - name: 'Checkout Repository'
  #       uses: actions/checkout@v3
  #     - name: Dependency Review
  #       uses: actions/dependency-review-action@v3
  #       with:
  #         fail-on-severity: moderate
  #     - name: archive production artifacts
  #       uses: actions/upload-artifact@v3
  #       with:
  #         name: build-artifacts
  #         path: |
  #             .git/**/*
  #             deployment/**/*
  #             docs/**/*
  #             ${{ github.workspace }}/source/app
  #             ${{ github.workspace }}/source/api              
  #             deploy_vtag.yml
  #             CHANGELOG.md
  #             .cfnnagignore
  #             .cfnnag_global_suppress_list
  #             .cfnnag_*

  # semgrep-scan:
  #   needs: semantic-validate
  #   runs-on: ubuntu-latest
  #   container:
  #     # A Docker image with Semgrep installed. Do not change this.
  #     image: returntocorp/semgrep
  #   # Skip any PR created by dependabot to avoid permission issues:
  #   if: (github.actor != 'dependabot[bot]')
  #   permissions:
  #     actions: read
  #     contents: read
  #     security-events: write
  #   steps:
  #     # Fetch project source with GitHub Actions Checkout.
  #     - uses: actions/checkout@v3
  #     # Run the "semgrep ci" command on the command line of the docker image.
  #     - run: semgrep ci --config auto --sarif --output=semgrep.sarif
  #     - name: Upload SARIF file for GitHub Advanced Security Dashboard
  #       uses: github/codeql-action/upload-sarif@v2
  #       with:
  #         sarif_file: semgrep.sarif
  #       if: always()

  # viperlight:
  #   runs-on: ubuntu-latest
  #   needs: semantic-validate
  #   env:
  #     CI: "false"
  #   steps:
  #     - name: Checkout
  #       uses: actions/checkout@v3
  #     - name: Viperlight Scan
  #       run: |
  #         wget -q https://viperlight-scanner.s3.amazonaws.com/latest/.viperlightrc
  #         wget -q https://viperlight-scanner.s3.amazonaws.com/latest/viperlight.zip
  #         unzip -q viperlight.zip -d viperlight
  #         rm -r ./viperlight.zip
  #         cd viperlight  
  #         ./install.sh
  #         viperlight --version
  #         echo "Content scanning utility installation complete `date`"
  #         echo "Starting content scanning `date` in `pwd`"
  #         echo "github.workspace is...>>>>>"
  #         ls -l ${{ github.workspace }}/source
  #         cd ${{ github.workspace }}/source
  #         viperlight scan -m files-contents -m files-aws -m files-binary -m files-entropy -m files-secrets
  #         echo "Completed content scanning `date`"

  # py-test:
  #   runs-on: ubuntu-latest
  #   needs: semantic-validate
  #   env:
  #     CI: 'true'
  #   steps:
  #     - name: Checkout
  #       uses: actions/checkout@v3
  #       with:
  #         ref: '${{ github.event.pull_request.head.ref }}'
  #         repository: '${{ github.event.pull_request.head.repo.full_name }}'
  #     - uses: actions/setup-python@v4
  #       with:
  #         python-version: '3.9'
  #     - name: Install dependencies
  #       run: |
  #         cd source/constructs/api
  #         pip3 install -r requirements.txt
  #         pip3 install pytest==7.4.2
  #         pip3 install pytest-mock==3.11.1
  #         pip3 install httpx==0.25.0
  #         pip3 install anyio==3.6.2
  #         pip3 install mock==5.1.0
  #         pip3 install mock-alchemy==0.2.6
  #     - name: Configure AWS credentials
  #       uses: aws-actions/configure-aws-credentials@v1
  #       with:
  #         aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CN }}
  #         aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CN }}
  #         aws-region: ${{ secrets.AWS_REGION_CN }}
  #     - name: Test with pytest
  #       run: |
  #         cd source/constructs/api
  #         python -m pytest pytest -s

  cdk-unit-test:
    runs-on: ubuntu-latest
    needs: semantic-validate
    env:
      CI: "false"
    steps:
      - name: demo test
        run: |
          true

  api-unit-test:
    runs-on: ubuntu-latest
    needs: semantic-validate
    env:
      CI: "false"
    steps:
      - name: demo test
        run: |
          true

  # code-build-portal:
  #   needs: [cdk-unit-test, api-unit-test]
  #   runs-on: ubuntu-latest
  #   env:
  #     CI: "false"
  #   steps:
  #     - name: Checkout source
  #       uses: actions/checkout@v3
  #       with:
  #         ref: ${{ github.event.pull_request.head.ref }}
  #         repository: ${{ github.event.pull_request.head.repo.full_name }}
  #     - name: Use Node.js 18.x
  #       uses: actions/setup-node@v3
  #       with:
  #         node-version: '18.x'
  #     - name: Build source
  #       run: |
  #         echo "Build FE START>>>>>>>>>>>>>>>"
  #         cd ${{ github.workspace }}/source/portal
  #         rm -rf node_modules
  #         npm install --legacy-peer-deps
  #         npm run build
  #         echo "Build FE END>>>>>>>>>>>>>>>"
  #         echo "FE Content is shown as below:"
  #         ls -L ${{ github.workspace }}/source/portal

  # code-build-backend:
  #   needs: [cdk-unit-test, api-unit-test]
  #   runs-on: ubuntu-latest
  #   env:
  #     CI: "false"
  #   steps:
  #     - name: Checkout source
  #       uses: actions/checkout@v3
  #       with:
  #         ref: ${{ github.event.pull_request.head.ref }}
  #         repository: ${{ github.event.pull_request.head.repo.full_name }}
  #     - name: Use Node.js 18.x
  #       uses: actions/setup-node@v3
  #       with:
  #         node-version: '18.x'
  #     - name: Install CDK
  #       run: |
  #         npm install -g aws-cdk
  #         cdk --version
  #     - name: Build source
  #       run: |
  #         echo "Build BE START>>>>>>>>>>>>>>>"
  #         cd ${{ github.workspace }}/source/constructs
  #         rm -rf node_modules
  #         npm install --legacy-peer-deps
  #         cdk synth
  #         echo "Build BE END>>>>>>>>>>>>>>>"
  #         echo "BE Content is shown as below:"
  #         ls -L ${{ github.workspace }}/source/constructs/cdk.out