pipeline.yml

name: Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # Allow to run this workflow manually
  workflow_dispatch:

concurrency:
  group: "build-and-deploy-${{ github.repository }}"
  cancel-in-progress: false

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: validate github workflow files to have pinned versions
        uses: digitalservicebund/github-actions/github-actions-linter@ca94f38ed2758daca16689e876dd0d399aa7d18a

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm

      - name: Cache npm dependencies
        id: cache-npm-deps
        uses: actions/cache@v4
        with:
          path: |
            **/node_modules
          key: "${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}"
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install dependencies
        if: steps.cache-npm-deps.outputs.cache-hit != 'true'
        run: npm ci

      - name: Build for tests
        run: npm run build

      - name: Check format
        run: npm run format:check

      - name: Lint
        run: npm run lint:check

      - name: Install E2E & A11y test dependencies
        run: |
          npx --yes playwright install --with-deps

      - name: Run E2E tests
        id: e2e
        run: npm run test:e2e
        env:
          WAIT_ON_TIMEOUT: 10000

      - uses: actions/upload-artifact@v4
        if: ${{ failure() && steps.e2e.outcome == 'failure' }}
        with:
          name: playwright-e2e-test-results
          path: test/e2e/playwright-report

      - name: Run A11y tests
        id: a11y
        run: npm run test:a11y
        env:
          # Use a different port (from the one used with E2E tests) to workaround problem in CI/GitHub Actions,
          # starting to occur with playwright/test 1.28.0:
          # Error: http://localhost:3002 is already used ...
          # See https://github.com/digitalservicebund/typescript-vite-application-template/actions/runs/3486985178/jobs/5834089375
          VITE_PORT: 3002
          WAIT_ON_TIMEOUT: 10000

      - uses: actions/upload-artifact@v4
        if: ${{ failure() && steps.a11y.outcome == 'failure' }}
        with:
          name: playwright-a11y-test-results
          path: test/a11y/playwright-report

      - name: Send status to Slack
        uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0
        if: ${{ failure() }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  audit-licenses:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm

      - name: Cache npm dependencies
        id: cache-npm-deps
        uses: actions/cache@v4
        with:
          path: |
            **/node_modules
          key: "${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}"
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install dependencies
        if: steps.cache-npm-deps.outputs.cache-hit != 'true'
        run: npm ci

      - name: Audit used licences
        run: npm run audit:licences

      - name: Send status to Slack
        uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0
        if: ${{ failure() }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  vulnerability-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Run Trivy vulnerability scanner
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # v0.24.0
        env:
          TRIVY_USERNAME: ${{ github.actor }}
          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
        with:
          scan-type: "fs"
          skip-dirs: "node_modules" # See https://github.com/aquasecurity/trivy/issues/1283
          format: "sarif"
          output: "trivy-results.sarif"

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@592977e6ae857384aa79bb31e7a1d62d63449ec5 # v2
        if: always() # Bypass non-zero exit code..
        with:
          sarif_file: "trivy-results.sarif"

      - name: Send status to Slack
        uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0
        if: ${{ failure() }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  deploy-to-ionos:
    runs-on: ubuntu-latest
    if: ${{ github.ref == 'refs/heads/main' }}
    needs:
      - test
      - audit-licenses
      - vulnerability-scan
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm

      - name: Cache npm dependencies
        id: cache-npm-deps
        uses: actions/cache@v4
        with:
          path: |
            **/node_modules
          key: "${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}"
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install dependencies
        if: steps.cache-npm-deps.outputs.cache-hit != 'true'
        run: npm ci

      - name: Build for production
        run: npm run generate
        env:
          NUXT_APP_BASE_URL: "/wie-viele-menschen/"

      - name: 📂 Sync files
        uses: sand4rt/ftp-deployer@518beaad91d1b18fd55a69321de7ed89080d2ae3 # v1.8
        with:
          sftp: true
          host: 217.160.187.5
          port: 22
          username: wie-viele-menschen-bot
          password: ${{ secrets.FTP_PASSWORD }}
          local_folder: ./.output/public/
          cleanup: true

      - name: Send status to Slack
        uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0
        if: ${{ failure() }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  deploy-to-github-pages:
    runs-on: ubuntu-latest
    if: ${{ github.ref == 'refs/heads/main' }}
    needs:
      - test
      - audit-licenses
      - vulnerability-scan
    permissions:
      id-token: write
      pages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm

      - name: Cache npm dependencies
        id: cache-npm-deps
        uses: actions/cache@v4
        with:
          path: |
            **/node_modules
          key: "${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}"
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install dependencies
        if: steps.cache-npm-deps.outputs.cache-hit != 'true'
        run: npm ci

      - name: Build for production
        run: npm run generate
        env:
          NUXT_APP_BASE_URL: "/wie-viele-menschen/"

      - name: Create redirect file
        run: |
          echo '<!DOCTYPE html>
          <html>
          <head>
              <meta http-equiv="refresh" content="0; url=https://digitalservice.bund.de/wie-viele-menschen/" />
              <title>Redirecting...</title>
          </head>
          <body>
              <p>If you are not redirected automatically, follow this <a href="https://digitalservice.bund.de/wie-viele-menschen/">link to the new page</a>.</p>
          </body>
          </html>' > ./.output/public/index.html

      - name: Setup Pages
        id: pages
        uses: actions/configure-pages@v5

      - name: Upload pages artifact
        uses: actions/upload-pages-artifact@v3
        with:
          path: ./.output/public

      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4