zxc-code-analysis.yaml

##
# Copyright (C) 2023-2024 Hedera Hashgraph, LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
##

name: "ZXC: Code Analysis"
# The purpose of this reusable workflow is to perform static code analysis and code coverage reporting.
# This reusable component is called by the following workflows:
# - .github/workflows/flow-pull-request-checks.yaml
# - .github/workflows/flow-build-application.yaml
#
# This workflow is only run if the pull request is coming from the original repository and not a fork.

on:
  workflow_call:
    inputs:
      enable-codecov-analysis:
        description: "CodeCov Analysis Enabled"
        type: boolean
        required: false
        default: false
      enable-codacy-coverage:
        description: "Codacy Coverage Enabled"
        type: boolean
        required: false
        default: false
      enable-e2e-coverage-report:
        description: "E2E Coverage Report Enabled"
        type: boolean
        required: false
        default: false
      enable-snyk-scan:
        description: "Snyk Scan Enabled"
        type: boolean
        required: false
        default: false
      node-version:
        description: "NodeJS Version:"
        type: string
        required: false
        default: "20.14.0"
      custom-job-label:
        description: "Custom Job Label:"
        type: string
        required: false
        default: "Analyze"
      e2e-standard-test-subdir:
        description: "E2E Standard Test Subdirectory:"
        type: string
        required: false
        default: "e2e-standard"
      e2e-mirror-node-test-subdir:
        description: "E2E Mirror Node Test Subdirectory:"
        type: string
        required: false
        default: "e2e-mirror-node"
      e2e-node-pem-stop-test-subdir:
        description: "E2E Node PEM Stop Test Subdirectory:"
        type: string
        required: false
        default: "e2e-node-pem-stop"
      e2e-node-pem-kill-test-subdir:
        description: "E2E Node PEM Kill Test Subdirectory:"
        type: string
        required: false
        default: "e2e-node-pem-kill"
      e2e-node-local-build-test-subdir:
        description: "E2E Node Local Build Test Subdirectory:"
        type: string
        required: false
        default: "e2e-node-local-build"
      e2e-node-add-test-subdir:
        description: "E2E Node Add Test Subdirectory:"
        type: string
        required: false
        default: "e2e-node-add"
      e2e-node-add-separate-commands-test-subdir:
        description: "E2E Node Add - Separate commands Test Subdirectory:"
        type: string
        required: false
        default: "e2e-node-add-separate-commands"
      e2e-node-update-test-subdir:
        description: "E2E Node Update Test Subdirectory:"
        type: string
        required: false
        default: "e2e-node-update"
      e2e-node-delete-test-subdir:
        description: "E2E Node Delete Test Subdirectory:"
        type: string
        required: false
        default: "e2e-node-delete"
      e2e-relay-test-subdir:
        description: "E2E Relay Test Subdirectory:"
        type: string
        required: false
        default: "e2e-relay"
      e2e-standard-coverage-report:
        description: "E2E Standard Coverage Report:"
        type: string
        required: false
        default: "E2E Standard Tests Coverage Report"
      e2e-mirror-node-coverage-report:
        description: "E2E Mirror Node Coverage Report:"
        type: string
        required: false
        default: "E2E Mirror Node Tests Coverage Report"
      e2e-node-pem-stop-coverage-report:
        description: "E2E Node PEM Stop Coverage Report:"
        type: string
        required: false
        default: "E2E Node PEM Stop Tests Coverage Report"
      e2e-node-pem-kill-coverage-report:
        description: "E2E Node PEM Kill Coverage Report:"
        type: string
        required: false
        default: "E2E Node PEM Kill Tests Coverage Report"
      e2e-node-local-build-coverage-report:
        description: "E2E Node Local Build Coverage Report:"
        type: string
        required: false
        default: "E2E Node Local Build Tests Coverage Report"
      e2e-node-add-coverage-report:
        description: "E2E Node Add Coverage Report:"
        type: string
        required: false
        default: "E2E Node Add Tests Coverage Report"
      e2e-node-add-separate-commands-coverage-report:
        description: "E2E Node Add - Separate commands Coverage Report:"
        type: string
        required: false
        default: "E2E Node Add - Separate commands Tests Coverage Report"
      e2e-node-update-coverage-report:
        description: "E2E Node Update Coverage Report:"
        type: string
        required: false
        default: "E2E Node Update Tests Coverage Report"
      e2e-node-delete-coverage-report:
        description: "E2E Node Delete Coverage Report:"
        type: string
        required: false
        default: "E2E Node Delete Tests Coverage Report"
      e2e-relay-coverage-report:
        description: "E2E Relay Coverage Report:"
        type: string
        required: false
        default: "E2E Relay Tests Coverage Report"
    secrets:
      snyk-token:
        description: "The Snyk access token is used by Snyk to analyze the code for vulnerabilities "
        required: false
      codecov-token:
        description: "The CodeCov access token is used by CodeCov.io to analyze the code coverage "
        required: false
      codacy-project-token:
        description: "The Codacy project token used to report code coverage."
        required: false

defaults:
  run:
    shell: bash

permissions:
  contents: read
  actions: read
  pull-requests: write
  checks: write
  statuses: write

jobs:
  analyze:
    name: ${{ inputs.custom-job-label || 'Analyze' }}
    runs-on: solo-linux-medium
    steps:
      - name: Checkout Code
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
        with:
          ref: ${{ github.event.workflow_run.head_branch }}
          fetch-depth: ${{ inputs.enable-sonar-analysis && '0' || '' }}

      - name: Setup Node with Retry
        uses: Wandalen/wretry.action@6feedb7dedadeb826de0f45ff482b53b379a7844 # v3.5.0
        with:
          action: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
          with: |
            node-version: ${{ inputs.node-version }}
            cache: npm
          attempt_limit: 3
          attempt_delay: 5000

      - name: Download Unit Test Coverage Report
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: ${{ (inputs.enable-codecov-analysis || inputs.enable-codacy-coverage) && !cancelled() && !failure() }}
        with:
          name: Unit Test Coverage Report
          path: 'coverage/unit'

      - name: Download E2E Standard Coverage Report
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: ${{ (inputs.enable-codecov-analysis || inputs.enable-codacy-coverage) && inputs.enable-e2e-coverage-report && !cancelled() && !failure() }}
        with:
          name: ${{ inputs.e2e-standard-coverage-report }}
          path: 'coverage/${{ inputs.e2e-standard-test-subdir }}'

      - name: Download E2E Mirror Node Coverage Report
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: ${{ (inputs.enable-codecov-analysis || inputs.enable-codacy-coverage) && inputs.enable-e2e-coverage-report && !cancelled() && !failure() }}
        with:
          name: ${{ inputs.e2e-mirror-node-coverage-report }}
          path: 'coverage/${{ inputs.e2e-mirror-node-test-subdir }}'

      - name: Download E2E Node PEM Stop Coverage Report
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: ${{ (inputs.enable-codecov-analysis || inputs.enable-codacy-coverage) && inputs.enable-e2e-coverage-report && !cancelled() && !failure() }}
        with:
          name: ${{ inputs.e2e-node-pem-stop-coverage-report }}
          path: 'coverage/${{ inputs.e2e-node-pem-stop-test-subdir }}'

      - name: Download E2E Node PEM Kill Coverage Report
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: ${{ (inputs.enable-codecov-analysis || inputs.enable-codacy-coverage) && inputs.enable-e2e-coverage-report && !cancelled() && !failure() }}
        with:
          name: ${{ inputs.e2e-node-pem-kill-coverage-report }}
          path: 'coverage/${{ inputs.e2e-node-pem-kill-test-subdir }}'

      - name: Download E2E Node Local Build Coverage Report
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: ${{ (inputs.enable-codecov-analysis || inputs.enable-codacy-coverage) && inputs.enable-e2e-coverage-report && !cancelled() && !failure() }}
        with:
          name: ${{ inputs.e2e-node-local-build-coverage-report }}
          path: 'coverage/${{ inputs.e2e-node-local-build-test-subdir }}'

      - name: Download E2E Node Add Coverage Report
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: ${{ (inputs.enable-codecov-analysis || inputs.enable-codacy-coverage) && inputs.enable-e2e-coverage-report && !cancelled() && !failure() }}
        with:
          name: ${{ inputs.e2e-node-add-coverage-report }}
          path: 'coverage/${{ inputs.e2e-node-add-test-subdir }}'

      - name: Download E2E Node Add - Separate commands Coverage Report
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: ${{ (inputs.enable-codecov-analysis || inputs.enable-codacy-coverage) && inputs.enable-e2e-coverage-report && !cancelled() && !failure() }}
        with:
          name: ${{ inputs.e2e-node-add-separate-commands-coverage-report }}
          path: 'coverage/${{ inputs.e2e-node-add-separate-commands-test-subdir }}'

      - name: Download E2E Node Update Coverage Report
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: ${{ (inputs.enable-codecov-analysis || inputs.enable-codacy-coverage) && inputs.enable-e2e-coverage-report && !cancelled() && !failure() }}
        with:
          name: ${{ inputs.e2e-node-update-coverage-report }}
          path: 'coverage/${{ inputs.e2e-node-update-test-subdir }}'

      - name: Download E2E Node Delete Coverage Report
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: ${{ (inputs.enable-codecov-analysis || inputs.enable-codacy-coverage) && inputs.enable-e2e-coverage-report && !cancelled() && !failure() }}
        with:
          name: ${{ inputs.e2e-node-delete-coverage-report }}
          path: 'coverage/${{ inputs.e2e-node-delete-test-subdir }}'

      - name: Download E2E Relay Coverage Report
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: ${{ (inputs.enable-codecov-analysis || inputs.enable-codacy-coverage) && inputs.enable-e2e-coverage-report && !cancelled() && !failure() }}
        with:
          name: ${{ inputs.e2e-relay-coverage-report }}
          path: 'coverage/${{ inputs.e2e-relay-test-subdir }}'

      - name: Download E2E Test Report
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: ${{ (inputs.enable-codecov-analysis || inputs.enable-codacy-coverage) && inputs.enable-e2e-coverage-report && !cancelled() && !failure() }}
        with:
          pattern: "e2e_test_report_*"
          path: "e2e_test_report"

      - name: Publish E2E Test Report
        uses: EnricoMi/publish-unit-test-result-action@82082dac68ad6a19d980f8ce817e108b9f496c2a # v2.17.1
        if: ${{ (inputs.enable-codecov-analysis || inputs.enable-codacy-coverage) && inputs.enable-e2e-coverage-report && !cancelled() && !failure() }}
        with:
          check_name: "E2E Test Report"
          files: "e2e_test_report/**/*.xml"

      - name: Publish To Codecov
        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
        if: ${{ inputs.enable-codecov-analysis && !cancelled() && !failure() }}
        env:
          CODECOV_TOKEN: ${{ secrets.codecov-token }}
        with:
          verbose: true
          directory: 'coverage'

      - name: Publish to Codacy
        env:
          CODACY_PROJECT_TOKEN: ${{ secrets.codacy-project-token }}
        if: ${{ inputs.enable-codacy-coverage && !cancelled() && !failure() }}
        run: bash <(curl -Ls https://coverage.codacy.com/get.sh) report -l Javascript $(find . -name 'lcov.info' -printf '-r %p ')

      - name: Setup Snyk
        env:
          SNYK_TOKEN: ${{ secrets.snyk-token }}
        if: ${{ inputs.enable-snyk-scan && !cancelled() && !failure() }}
        run: npm install -g snyk snyk-to-html @wcj/html-to-markdown-cli

      - name: Snyk Scan
        id: snyk
        env:
          SNYK_TOKEN: ${{ secrets.snyk-token }}
        if: ${{ inputs.enable-snyk-scan && !cancelled() && !failure() }}
        run: snyk test --org=release-engineering-N6EoZVZn3jw4qNuVkiG5Qs --all-projects --severity-threshold=high --json-file-output=snyk-test.json

      - name: Snyk Code
        id: snyk-code
        env:
          SNYK_TOKEN: ${{ secrets.snyk-token }}
        if: ${{ inputs.enable-snyk-scan && !cancelled() && !failure() }}
        run: snyk code test --org=release-engineering-N6EoZVZn3jw4qNuVkiG5Qs --severity-threshold=high --json-file-output=snyk-code.json

      - name: Publish Snyk Results
        if: ${{ inputs.enable-snyk-scan && !cancelled() && !failure() }}
        run: |
          if [[ -f "snyk-test.json" && -n "$(cat snyk-test.json | tr -d '[:space:]')" ]]; then
            snyk-to-html -i snyk-test.json -o snyk-test.html --summary
            html-to-markdown snyk-test.html -o snyk
            cat snyk/snyk-test.html.md >> $GITHUB_STEP_SUMMARY
          fi

      - name: Publish Snyk Code Results
        if: ${{ inputs.enable-snyk-scan && !cancelled() && !failure() }}
        run: |
          if [[ -f "snyk-code.json" && -n "$(cat snyk-code.json | tr -d '[:space:]')" ]]; then
            snyk-to-html -i snyk-code.json -o snyk-code.html --summary
            html-to-markdown snyk-code.html -o snyk
            cat snyk/snyk-code.html.md >> $GITHUB_STEP_SUMMARY
          fi

      - name: Check Snyk Files
        if: ${{ always() }}
        run: |
          echo "::group::Snyk File List"
            ls -lah snyk* || true
          echo "::endgroup::"
          echo "::group::Snyk Test Contents"
            cat snyk-test.json || true
          echo "::endgroup::"
          echo "::group::Snyk Code Contents"
            cat snyk-code.json || true
          echo "::endgroup::"

      - name: Publish Snyk Reports
        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
        if: ${{ inputs.enable-snyk-scan && !cancelled() && !failure() }}
        with:
          name: Snyk Reports
          path: |
            snyk-*.html
            snyk-*.json