build.yml

name: Build

on: [push, pull_request]

jobs:

  # -- TESTS ------------------------------------------------------------------
  tests:
    runs-on: ubuntu-latest

    steps:
      - name: Harden GitHub Actions Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2

      - name: Run ansible-lint
        uses: ansible-community/ansible-lint-action@9b022b66407018ebb6d44c904f4a386766d34368 # v6.14.4

  # -- SAST SCAN --------------------------------------------------------------
  code-security:
    runs-on: ubuntu-latest
    needs: tests
    # Skip any PR created by dependabot to avoid permission issues
    if: (github.actor != 'dependabot[bot]')

    steps:
      - name: Harden GitHub Actions Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2

      - name: Perform Scan
        uses: ShiftLeftSecurity/scan-action@master

        env:
          WORKSPACE: https://github.com/${{ github.repository }}/blob/${{ github.sha }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SCAN_ANNOTATE_PR: true

      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          name: reports
          path: reports

  # -- RELEASE ----------------------------------------------------------------
  release:
    runs-on: ubuntu-latest
    needs: code-security
    if: github.ref == 'refs/heads/master'

    steps:
      - name: Harden GitHub Actions Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2

      - name: Semantic Release
        uses: cycjimmy/semantic-release-action@8e58d20d0f6c8773181f43eb74d6a05e3099571d # v3.4.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}