stage-1-commit.yaml

name: "Commit stage"

on:
  workflow_call:
    inputs:
      build_datetime:
        description: "Build datetime, set by the CI/CD pipeline workflow"
        required: true
        type: string
      build_timestamp:
        description: "Build timestamp, set by the CI/CD pipeline workflow"
        required: true
        type: string
      build_epoch:
        description: "Build epoch, set by the CI/CD pipeline workflow"
        required: true
        type: string
      nodejs_version:
        description: "Node.js version, set by the CI/CD pipeline workflow"
        required: true
        type: string
      python_version:
        description: "Python version, set by the CI/CD pipeline workflow"
        required: true
        type: string
      terraform_version:
        description: "Terraform version, set by the CI/CD pipeline workflow"
        required: true
        type: string
      version:
        description: "Version of the software, set by the CI/CD pipeline workflow"
        required: true
        type: string

jobs:
  scan-secrets:
    name: "Scan secrets"
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v5.0.0
        with:
          fetch-depth: 0 # Full history is needed to scan all commits
      - name: "Scan secrets"
        uses: ./.github/actions/scan-secrets
  check-file-format:
    name: "Check file format"
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v5.0.0
        with:
          fetch-depth: 0 # Full history is needed to compare branches
      - name: "Check file format"
        uses: ./.github/actions/check-file-format
  check-markdown-format:
    name: "Check Markdown format"
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v5.0.0
        with:
          fetch-depth: 0 # Full history is needed to compare branches
      - name: "Check Markdown format"
        uses: ./.github/actions/check-markdown-format
  terraform-docs:
    name: "Run terraform-docs"
    runs-on: ubuntu-latest
    needs: detect-terraform-changes
    if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
    permissions:
      contents: write
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v5.0.0
        with:
          fetch-depth: 0 # Full history is needed to compare branches
      - name: "Check to see if Terraform Docs are up-to-date"
        run: |
          make terraform-docs
      - name: "Stage changes"
        run: |
          git add infrastructure/terraform/**/*.md
      - name: "Check for changes in Terraform Docs"
        run: |
          if git diff --cached --name-only | grep -qE '\.md$'; then
            echo "Markdown files have changed. Please run 'make terraform-docs' and commit the changes."
            exit 1
          fi
  check-english-usage:
    name: "Check English usage"
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v5.0.0
        with:
          fetch-depth: 0 # Full history is needed to compare branches
      - name: "Check English usage"
        uses: ./.github/actions/check-english-usage
  check-todo-usage:
    name: "Check TODO usage"
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v5.0.0
        with:
          fetch-depth: 0 # Full history is needed to compare branches
      - name: "Check TODO usage"
        uses: ./.github/actions/check-todo-usage
  detect-terraform-changes:
    name: "Detect Terraform Changes"
    runs-on: ubuntu-latest
    outputs:
      terraform_changed: ${{ steps.check.outputs.terraform_changed }}
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v5.0.0

      - name: "Check for Terraform changes"
        id: check
        run: |
          git fetch origin main || true  # Ensure you have the latest main branch
          CHANGED_FILES=$(git diff --name-only HEAD origin/main)
          echo "Changed files: $CHANGED_FILES"

          if echo "$CHANGED_FILES" | grep -qE '\.tf$'; then
            echo "Terraform files have changed."
            echo "terraform_changed=true" >> $GITHUB_OUTPUT
          else
            echo "No Terraform changes detected."
            echo "terraform_changed=false" >> $GITHUB_OUTPUT
          fi
  lint-terraform:
    name: "Lint Terraform"
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs: detect-terraform-changes
    if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v5.0.0
      - name: "Lint Terraform"
        uses: ./.github/actions/lint-terraform
  trivy:
    name: "Trivy Scan"
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs: detect-terraform-changes
    if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v5.0.0
      - name: "Setup ASDF"
        uses: asdf-vm/actions/setup@v4
      - name: "Perform Setup"
        uses: ./.github/actions/setup
      - name: "Trivy Scan"
        uses: ./.github/actions/trivy
  count-lines-of-code:
    name: "Count lines of code"
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    timeout-minutes: 5
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v5.0.0
      - name: "Count lines of code"
        uses: ./.github/actions/create-lines-of-code-report
        with:
          build_datetime: "${{ inputs.build_datetime }}"
          build_timestamp: "${{ inputs.build_timestamp }}"
          idp_aws_report_upload_account_id: "${{ secrets.IDP_AWS_REPORT_UPLOAD_ACCOUNT_ID }}"
          idp_aws_report_upload_region: "${{ secrets.IDP_AWS_REPORT_UPLOAD_REGION }}"
          idp_aws_report_upload_role_name: "${{ secrets.IDP_AWS_REPORT_UPLOAD_ROLE_NAME }}"
          idp_aws_report_upload_bucket_endpoint: "${{ secrets.IDP_AWS_REPORT_UPLOAD_BUCKET_ENDPOINT }}"
  scan-dependencies:
    name: "Scan dependencies"
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    timeout-minutes: 5
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v5.0.0
      - name: "Scan dependencies"
        uses: ./.github/actions/scan-dependencies
        with:
          build_datetime: "${{ inputs.build_datetime }}"
          build_timestamp: "${{ inputs.build_timestamp }}"
          idp_aws_report_upload_account_id: "${{ secrets.IDP_AWS_REPORT_UPLOAD_ACCOUNT_ID }}"
          idp_aws_report_upload_region: "${{ secrets.IDP_AWS_REPORT_UPLOAD_REGION }}"
          idp_aws_report_upload_role_name: "${{ secrets.IDP_AWS_REPORT_UPLOAD_ROLE_NAME }}"
          idp_aws_report_upload_bucket_endpoint: "${{ secrets.IDP_AWS_REPORT_UPLOAD_BUCKET_ENDPOINT }}"

  detect-event-schema-package-changes:
    name: "Check for changes to event schema package compared to main branch"
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      changed: ${{ steps.check.outputs.changed }}
      main_version: ${{ steps.check.outputs.main_version }}

    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Detect package changes and current version
        id: check
        run: |
          git fetch origin main

          if git diff --quiet origin/main...HEAD -- packages/event-schemas; then
            echo "No changes in event schemas package"
            echo "changed=false" >> $GITHUB_OUTPUT
          else
            echo "Changes detected in event schemas"
            echo "changed=true" >> $GITHUB_OUTPUT
          fi

          if content=$(git show origin/main:packages/event-schemas/package.json 2>/dev/null); then
            version=$(jq -r .version <<< $content);
          else
            version=null;
          fi

          echo "Detected package version $version in main branch"
          echo "main_version=$version" >> $GITHUB_OUTPUT

  check-schemas-generated:
    name: Check event schemas have been regenerated
    needs: detect-event-schema-package-changes
    if: needs.detect-event-schema-package-changes.outputs.changed == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4

      - name: "Restore node_modules from cache"
        uses: ./.github/actions/node-modules-cache
        with:
          node_version: "${{ inputs.nodejs_version }}"

      - name: Re-generate schemas
        run: npm --workspace packages/event-schemas run generate-json-schemas

      - name: Check for schema changes
        run: git diff --quiet packages/event-schemas/schemas

  check-schema-version-change:
    name: Check event schema version has been updated
    needs: detect-event-schema-package-changes
    if: needs.detect-event-schema-package-changes.outputs.changed == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Check schema versions
        run: |
          source scripts/is_valid_increment.sh

          main_version="${{ needs.detect-event-schema-package-changes.outputs.main_version }}"
          echo "Main version: ${{ needs.detect-event-schema-package-changes.outputs.main_version }}"

          local_version=$(jq -r '.version' packages/event-schemas/package.json)
          echo "Local version: $local_version"

          if ! is_valid_increment "$main_version" "$local_version" ; then
            echo "Error: Event Schema package has changed, but new version ($local_version) is not a valid increment from latest version on main branch ($main_version)."
            exit 1
          fi