ci-sbt.yml

# Find full documentation here https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions
name: CI

on:
  pull_request:

  # Manual invocation.
  workflow_dispatch:

  push:
    branches:
      - main
jobs:
  CI:
    runs-on: ubuntu-latest

    # See https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
    permissions:
      id-token: write
      contents: read
      pull-requests: write # required by guardian/actions-riff-raff
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      # Configuring caching is also recommended.
      # See https://github.com/actions/setup-java
      - name: Setup Java 11
        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
        with:
          java-version: '11'
          distribution: 'corretto'
          cache: 'sbt'

      - name: Setup Node
        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'
          cache-dependency-path: 'cdk/package-lock.json'

      # This step creates an environment variable `BUILD_NUMBER`.
      # It is used by:
      #   - The `script/ci` script
      #   - The CDK infrastructure
      #   - The `guardian/actions-riff-raff` GitHub Action
      - run: |
          LAST_TEAMCITY_BUILD=1265
          echo "BUILD_NUMBER=$(( $GITHUB_RUN_NUMBER + $LAST_TEAMCITY_BUILD ))" >> $GITHUB_ENV

      - name: Run script/ci
        run: ./script/ci

      - uses: guardian/actions-riff-raff@6ddd4acd261c4265995908a68f0592ad1604b56e # v4.1.7
        with:
          projectName: security-hq
          roleArn: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
          buildNumber: ${{ env.BUILD_NUMBER }}
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          configPath: hq/conf/riff-raff.yaml
          contentDirectories: |
            security-hq-cfn:
              - cdk/cdk.out/security-hq.template.json
            security-hq:
              - dist