ci.yml

name: CI

on:
  pull_request:
    branches: [dev, stg, prd]
    types: [opened, reopened, synchronize, edited]
    paths-ignore:
      - 'README.md'
      - 'LICENSE'
      - '.gitignore'
env:
  node_version: "22.x"
  tf_version: "1.9.8" # must match value in terraform-iac/*/app/main.tf
  FORCE_COLOR: 3

jobs:
  env:
    name: Set Env Vars
    timeout-minutes: 1
    runs-on: ubuntu-latest
    steps:
      - name: Set up DEV Environment Variables
        if: github.base_ref == 'dev'
        run: |
          matrix='{
            "env":[
              {
                "tf_working_dir":"./terraform-iac/dev/app",
                "aws_account":"977306314792",
                "aws_gha_role":"hw-lambda-api-dev-gha"
              }
            ]
          }'
          echo matrix=`echo $matrix | jq -c .` >> $GITHUB_ENV

      - name: Set up STG Environment Variables
        if: github.base_ref == 'stg'
        run: |
          matrix='{
            "env":[
              {
                "tf_working_dir":"./terraform-iac/stg/app",
                "aws_account":"977306314792",
                "aws_gha_role":"hw-lambda-api-stg-gha"
              }
            ]
          }'
          echo matrix=`echo $matrix | jq -c .` >> $GITHUB_ENV

      - name: Set up PRD/CPY Environment Variables
        if: github.base_ref == 'prd'
        run: |
          matrix='{
            "env":[
              {
                "tf_working_dir":"./terraform-iac/prd/app",
                "aws_account":"539738229445",
                "aws_gha_role":"hw-lambda-api-prd-gha"
              },
              {
                "tf_working_dir":"./terraform-iac/cpy/app",
                "aws_account":"539738229445",
                "aws_gha_role":"hw-lambda-api-cpy-gha"
              }
            ]
          }'
          echo matrix=`echo $matrix | jq -c .` >> $GITHUB_ENV

    outputs:
      matrix: ${{ env.matrix }}

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 3
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.node_version }}
          cache: npm
          cache-dependency-path: '**/package-lock.json'

      - name: npm ci
        working-directory: src
        run: npm ci --prefer-offline

      - name: npm test
        working-directory: src
        run: npm test

      - name: Report test coverage to Codecov
        uses: codecov/codecov-action@v5
        if: env.CODECOV_TOKEN
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  audit:
    name: Audit
    runs-on: ubuntu-latest
    timeout-minutes: 3
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.node_version }}

      # We don't need to install deps to audit them

      - name: npm audit
        working-directory: src
        run: npm audit --audit-level=critical

  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 3
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.node_version }}
          cache: npm
          cache-dependency-path: '**/package-lock.json'

      - name: npm ci
        working-directory: src
        run: npm ci --prefer-offline

      - name: npm lint
        working-directory: src
        run: npm run lint

  format:
    name: Terraform Format
    timeout-minutes: 3
    runs-on: ubuntu-latest
    needs: env
    strategy:
      matrix: ${{ fromJson(needs.env.outputs.matrix) }}
      fail-fast: false
    steps:
      - uses: actions/checkout@v4

      - name: Terraform Setup
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.tf_version }}

      - name: Terraform Format
        working-directory: "./"
        run: terraform fmt -check -recursive

  plan:
    name: Terraform Plan
    timeout-minutes: 6
    runs-on: ubuntu-latest
    needs: env
    strategy:
      matrix: ${{ fromJson(needs.env.outputs.matrix) }}
      fail-fast: false
    permissions:
      contents: read
      actions: read
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: "arn:aws:iam::${{ matrix.env.aws_account }}:role/${{ matrix.env.aws_gha_role }}"
          role-session-name: ${{ github.sha }}
          aws-region: us-west-2

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.node_version }}
          cache: npm
          cache-dependency-path: '**/package-lock.json'

      - name: Build Lambda
        working-directory: src
        run: |
          npm ci --production --prefer-offline
          zip -r lambda.zip *

      - name: Terraform Setup
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.tf_version }}

      - name: Terraform Init
        working-directory: ${{ matrix.env.tf_working_dir }}
        run: terraform init

      - name: Terraform Plan
        working-directory: ${{ matrix.env.tf_working_dir }}
        run: terraform plan -input=false -out plan -lock=false

      - name: Comment Terraform Plan
        uses: byu-oit/github-action-tf-plan-comment@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          working-directory: ${{ matrix.env.tf_working_dir }}
          terraform-plan-file: plan

      - name: Analyze Terraform Plan
        uses: byu-oit/github-action-tf-plan-analyzer@v2
        with:
          working-directory: ${{ matrix.env.tf_working_dir }}
          terraform-plan-file: plan
          divvycloud-username: ${{ secrets.DIVVYCLOUD_USERNAME }}
          divvycloud-password: ${{ secrets.DIVVYCLOUD_PASSWORD }}