ci.yml

name: ci

env:
  NODE_VERSION: 20

permissions: read-all

on:
  push:
    branches:
      - main
    paths-ignore:
      - "**/*.md"
  pull_request:
    paths-ignore:
      - "**/*.md"

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: npm ci
      - run: npm audit

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: npm ci
      - run: npx turbo run lint --filter=...[HEAD^1]

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: npm ci
      - run: npx turbo run test --filter=...[HEAD^1]

  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - run: npm ci
      - run: npx turbo run build --filter=...[HEAD^1]
  
  sonarcloud:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - name: SonarCloud Scan
      uses: sonarsource/sonarcloud-github-action@master
      env:
        NODE_VERSION: ${{ env.NODE_VERSION }}
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
    
  # trigger-deploy:
  #   if: github.ref == 'refs/heads/main'
  #   runs-on: ubuntu-latest
  #   needs: [audit, lint, test, build, sonarcloud]
  #   steps:
  #     - uses: actions/checkout@v4
  #     - run: gh workflow run deploy.yml -f environment=dev
  #       env:
  #         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}