ci-test.yml

name: Scan & Test

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

env:
  CARGO_TERM_COLOR: always

jobs:
  trivy:
    name: Dependency security scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      # Report all vulnerabilities in security tab
      - name: Report on all vulnerabilities
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          hide-progress: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          
      # Fail the job on critical vulnerabiliies with fix available
      - name: Fail on critical vulnerabilities
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          hide-progress: true
          format: 'table'
          severity: 'CRITICAL'
          exit-code: '1'
      
      - name: Upload scan results
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

  format:
    name: Format
    needs: ['trivy']
    if: ${{ always() }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v3
      
      - name: Run cargo fmt
        run: cargo fmt --all -- --check

  clippy:
    name: Clippy
    needs: ['trivy']
    if: ${{ always() }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v3

      - name: Cache binaries
        uses: actions/cache@v3
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
            dex/target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

      - name: Run cargo clippy
        run: cargo clippy -- -D warnings
  
  test:
    name: Cargo test
    needs: ['trivy']
    if: ${{ always() }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        path: ['Cargo.toml',
               'dex/Cargo.toml']
    env:
      PROGRAM_PATH: ${{ matrix.path }}
    steps:
      - name: Checkout sources
        uses: actions/checkout@v3

      - name: Cache binaries
        uses: actions/cache@v3
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
            dex/target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

      - name: Run tests
        run: |
          cargo test --manifest-path ${{ matrix.path }} --workspace

  pass:
    name: All tests pass
    needs: ['trivy', 'format', 'clippy', 'test']
    runs-on: ubuntu-latest
    steps:
      - run: echo ok