audit_and_lint.yml

name: Synpress CI

on:
  push:
  pull_request:
    branches: [master, dev]

concurrency:
  group:
    '${{ github.workflow }} @ ${{ github.event.pull_request.head.label ||
    github.head_ref || github.ref }}'
  cancel-in-progress: true

jobs:
  audit:
    if:
      github.ref == 'refs/heads/master' || github.ref == 'refs/heads/dev' ||
      github.event_name == 'pull_request'
    runs-on: ubuntu-latest

    container:
      image: synthetixio/docker-sec-tools:18.16-alpine

    steps:
      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # pin@v2

      - name: Audit dependencies
        run: audit-ci --critical --report-type full

  build:
    needs: audit
    if:
      always() && (needs.audit.result == 'success' || needs.audit.result ==
      'skipped')
    runs-on: ubuntu-latest

    container:
      image: synthetixio/docker-node:18.16-alpine

    steps:
      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # pin@v2

      - name: Set pnpm cache directory
        run: pnpm config set store-dir .pnpm-store
        continue-on-error: true

      - name: Setup cache
        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # pin@v2
        with:
          path: |
            .pnpm-store
            node_modules
          key: ${{ runner.os }}-pnpm-v1-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-v1-
        continue-on-error: true

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --prefer-offline

      - name: Lint
        if:
          github.ref == 'refs/heads/master' || github.ref == 'refs/heads/dev' ||
          github.event_name == 'pull_request'
        run: pnpm lint
        # run: yarn lint:sarif

      # - name: Upload lint results
      #   if:
      #     always() && (github.ref == 'refs/heads/master' || github.ref ==
      #     'refs/heads/dev' || github.event_name == 'pull_request')
      #   uses: github/codeql-action/upload-sarif@32dc499307d133bb5085bae78498c0ac2cf762d5 # pin@codeql-bundle-20210517
      #   with:
      #     sarif_file: lint-results.sarif
      #   continue-on-error: true