ci.yml

name: orca:npm:ci

on:
  push:
    branches:
      - master

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      actions: write
    steps:
      - uses: actions/checkout@v2
      - name: Use Node.js 20
        uses: actions/setup-node@v3
        with:
          node-version: 20.12.2
      - name: npm install, build, and test
        run: |
          npm ci
          npm run lint
          npm run dist
        env:
          HUSKY_SKIP_INSTALL: 1
          CI: true
      - name: run security audit of npm packages
        run: |
          npm run audit-ci
      - name: run security check on code
        id: code_security_scan
        run: |
          pip install --upgrade njsscan
          njsscan .
      - name: scan for exposed aws secrets
        run: |
          git clone https://github.com/awslabs/git-secrets.git
          cd ./git-secrets
          sudo make install
          cd ../
          rm -rf git-secrets
          git secrets --register-aws
          git-secrets --scan -r
      - name: "Publish version of package to NPM registry"
        uses: JS-DevTools/npm-publish@v1
        id: publish
        with:
          token: ${{ secrets.NPM_TOKEN }}
          check-version: true
      - name: Create a Release
        if: steps.publish.outputs.type != 'none'
        id: create_release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ steps.publish.outputs.version }}
          release_name: Release ${{ steps.publish.outputs.version }}
          body: Automated release message to be implemented.
          draft: false
          prerelease: false