ci.yml

name: Continuous Integration

on:
  pull_request:
    branches:
      - main
  push:
    branches: [main, development, staging]
    paths-ignore:
      - '.github/**' # We don't want to trigger when we update the workflows.
      - 'docs/**' # We don't want to trigger when we update the docs.
      - '*.md'

jobs:

  unit-tests:
    name: Unit Tests
    secrets: inherit # https://docs.github.com/en/actions/using-workflows/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow
    uses: ./.github/workflows/unit_test_reusable.yml

  codeql-analysis:
    permissions:
      actions: read
      contents: read
      security-events: write
    name: CodeQL Scan
    uses: ./.github/workflows/security_codeql.yml

  semgrep-analysis:
    permissions:
      security-events: write
    name: Semgrep Scan
    uses: ./.github/workflows/security_semgrep.yml

  lint:
    name: Linting
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
      - uses: ./.github/actions/setup-python

      - name: Lint backend
        working-directory: ./backend/ops_api
        run: pipenv run nox -s lint

      - uses: ./.github/actions/setup-javascript

      - name: Lint frontend
        working-directory: ./frontend
        run: yarn lint