Skip to content

Commit b3cd797

Browse files
chrisbloechrisbloe
authored
[PRM-537] Introduce markdown validation check on PRs (#910)
1 parent bdd8923 commit b3cd797

File tree

8 files changed

+169
-348
lines changed

8 files changed

+169
-348
lines changed

‎.github/workflows/automated-pr-validator.yml‎

Lines changed: 118 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,12 @@ on:
66
- main
77
types: [opened, edited, synchronize]
88

9-
permissions:
10-
contents: read
11-
pull-requests: read
12-
139
jobs:
1410
checklist_validator:
1511
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
14+
pull-requests: read
1615
steps:
1716
- name: Checkout repository
1817
uses: actions/checkout@v6
@@ -27,3 +26,118 @@ jobs:
2726
python3 scripts/github/checklist_validator/main.py
2827
env:
2928
PR_BODY: ${{ github.event.pull_request.body }}
29+
30+
sbom_scan:
31+
name: SBOM Repo Scan
32+
runs-on: ubuntu-latest
33+
permissions:
34+
actions: read # Required for anchore/sbom-action
35+
contents: write # Required for anchore/sbom-action
36+
id-token: write # Required for requesting the JWT
37+
pull-requests: write
38+
steps:
39+
- uses: actions/checkout@v6
40+
with:
41+
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
42+
43+
- uses: anchore/sbom-action@v0
44+
with:
45+
path: "."
46+
format: cyclonedx-json
47+
output-file: sbom-repo-${{ github.event.repository.name }}-${{ github.sha }}.cdx.json
48+
49+
- uses: anchore/scan-action@v7
50+
id: sbom-scan
51+
with:
52+
sbom: sbom-repo-${{ github.event.repository.name }}-${{ github.sha }}.cdx.json
53+
fail-build: true
54+
severity-cutoff: low
55+
only-fixed: true
56+
output-format: sarif
57+
58+
- name: Upload Anchore scan SARIF report
59+
uses: github/codeql-action/upload-sarif@v3
60+
if: always()
61+
with:
62+
sarif_file: ${{ steps.sbom-scan.outputs.sarif }}
63+
64+
- name: Add/Update SBOM failure comment
65+
uses: actions/github-script@v8
66+
if: always() && failure()
67+
with:
68+
script: |
69+
// 1. Retrieve existing bot comments for the PR
70+
const { data: comments } = await github.rest.issues.listComments({
71+
owner: context.repo.owner,
72+
repo: context.repo.repo,
73+
issue_number: context.issue.number,
74+
})
75+
76+
const botComment = comments.find(comment => {
77+
return comment.user.type === 'Bot' && comment.body.includes('Code security issues found')
78+
})
79+
80+
// 2. Prepare format of the comment
81+
const output = `### Code security issues found
82+
83+
View full details [here](https://github.com/${{ github.repository }}/security/code-scanning?query=is%3Aopen+pr%3A${{ github.event.pull_request.number }}).`;
84+
85+
// 3. If we have a comment, update it, otherwise create a new one
86+
if (botComment) {
87+
github.rest.issues.deleteComment({
88+
owner: context.repo.owner,
89+
repo: context.repo.repo,
90+
comment_id: botComment.id,
91+
body: output
92+
})
93+
}
94+
95+
github.rest.issues.createComment({
96+
issue_number: context.issue.number,
97+
owner: context.repo.owner,
98+
repo: context.repo.repo,
99+
body: output
100+
})
101+
102+
- name: Delete SBOM failure comment
103+
uses: actions/github-script@v8
104+
if: always() && success()
105+
with:
106+
script: |
107+
// 1. Retrieve existing bot comments for the PR
108+
const { data: comments } = await github.rest.issues.listComments({
109+
owner: context.repo.owner,
110+
repo: context.repo.repo,
111+
issue_number: context.issue.number,
112+
})
113+
114+
const botComment = comments.find(comment => {
115+
return comment.user.type === 'Bot' && comment.body.includes('Code security issues found')
116+
})
117+
118+
// 2. If we have a comment, update it, otherwise create a new one
119+
if (botComment) {
120+
github.rest.issues.deleteComment({
121+
owner: context.repo.owner,
122+
repo: context.repo.repo,
123+
comment_id: botComment.id
124+
})
125+
}
126+
127+
markdown-validation:
128+
name: Markdown Validation
129+
runs-on: ubuntu-latest
130+
permissions:
131+
contents: read
132+
steps:
133+
- name: Checkout
134+
uses: actions/checkout@v6
135+
with:
136+
fetch-depth: 0
137+
138+
- name: Run Markdown Validation Script
139+
id: validate
140+
run: |
141+
BRANCH_NAME=${{ github.event.repository.default_branch }}
142+
chmod +x scripts/markdown-validator.sh
143+
scripts/markdown-validator.sh

‎.github/workflows/automated-sbom-repo-scan.yml‎

Lines changed: 0 additions & 104 deletions
This file was deleted.

‎.markdownlint.jsonc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"MD013": false,
3+
"MD033": false
4+
}

‎README.md‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,10 @@
11
# national-document-repository
22

3-
## Lamda Function Intro
3+
## Links
44

5-
Our Lambda function readme can be found [here](lambdas/README.md)
6-
7-
## React User Interface Intro
8-
9-
Our React User Interface readme can be found [here](app/README.md)
10-
11-
## End-to-End Tests Intro
12-
13-
Our E2E test readme can be found [here](lambdas/tests/e2e/README.md). We have E2E tests for our FHIR endpoints and APIM setup.
5+
- [Lambda function README.md](lambdas/README.md).
6+
- [React User Interface README.md](app/README.md).
7+
- [E2E test README.md](lambdas/tests/e2e/README.md) (we have E2E tests for our FHIR endpoints and APIM setup).
148

159
## Installation
1610

‎app/README.md‎

Lines changed: 11 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,14 @@
1-
## National Document Repository User Interface
1+
# National Document Repository User Interface
22

3-
### Intro
3+
## Intro
44

55
The National Document Repository user interface (UI) has been developed with React. This is a developer's guide to run the UI and tools locally.
66

7-
## Table Of Contents
7+
## Requirements
88

9-
1. [Setup](#setup)
10-
2. [Running Locally](#running-locally)
11-
3. [Testing](#testing)
12-
4. [Accessibility](#accessibility)
13-
5. [Design](#design)
14-
15-
### Requirements
16-
17-
- Node: Version 24.x
18-
- NPM: this should come installed with Node but if not version 11.4.1 or greater is recommended.
19-
- Browser: Of your choice, although Chrome has better development tools.
9+
- Node: Version 24.x
10+
- NPM: this should come installed with Node but if not version 11.4.1 or greater is recommended.
11+
- Browser: Of your choice, although Chrome has better development tools.
2012

2113
## Setup
2214

@@ -46,7 +38,7 @@ Once the packages have been installed, you can then run the app through the foll
4638
make start
4739
```
4840

49-
Once everything is up and running you should see a prompt in the CLI that the app is running on http://localhost:xxxx, where xxxx is the value of PORT specified in `.env` file. You should now be able to visit the site in a browser of your choice.
41+
Once everything is up and running you should see a prompt in the CLI that the app is running on <http://localhost:xxxx>, where xxxx is the value of PORT specified in `.env` file. You should now be able to visit the site in a browser of your choice.
5042

5143
## Testing
5244

@@ -82,10 +74,10 @@ This will open a new Chromium window with the options to either run the E2E test
8274

8375
## Accessibility
8476

85-
- [WAVE Chrome extension](https://chrome.google.com/webstore/detail/wave-evaluation-tool/jbbplnpkjmmeebjpijfedlgcdilocofh)
86-
- Use a screen reader
87-
- Use keyboard navigation
88-
- Use NHS components rather than custom styling
77+
- [WAVE Chrome extension](https://chrome.google.com/webstore/detail/wave-evaluation-tool/jbbplnpkjmmeebjpijfedlgcdilocofh)
78+
- Use a screen reader
79+
- Use keyboard navigation
80+
- Use NHS components rather than custom styling
8981

9082
## Design
9183

0 commit comments

Comments
 (0)