ums/.github/workflows/ci.yml at main · beyondnetcode/ums · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
name: UMS Monorepo CI

on:
  pull_request:
    branches: [ main, develop ]
  push:
    branches: [ main, develop ]

jobs:
  # 1. Total Quality Control and Build Validation
  ci:
    name: Build, Lint and Test (CI)
    runs-on: ubuntu-latest
    # El workspace npm/nx del monorepo vive bajo src/, no en la raíz del repo.
    defaults:
      run:
        working-directory: src
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Required for SonarCloud analysis

      - name: Setup Node.js v22
        uses: actions/setup-node@v4
        with:
          node-version: 22 # React Router v8 exige node >= 22
          cache: 'npm'
          cache-dependency-path: src/package-lock.json

      - name: Install Dependencies
        run: npm ci

      - name: Security Vulnerability Audit
        # Auditamos lo que se DESPLIEGA (dependencias de producción). Las vulnerabilidades
        # high actuales son todas de tooling de build (eslint/nx/sonarjs/postcss → minimatch/
        # brace-expansion DoS, axios empaquetado por nx); no llegan al runtime. `--omit=dev`
        # da 0 vuln de producción sin enmascarar riesgo real de lo entregado.
        run: npm audit --omit=dev --audit-level=high

      # Este job es la pipeline JS/frontend del monorepo. El backend .NET tiene su propia
      # CI dedicada (.github/workflows/build.yml, con setup-dotnet), así que aquí se scopea a
      # `app-web` — este runner no instala el SDK .NET 10 y `dotnet test/build` fallaría.
      - name: Run Global Linter
        run: npx nx run-many --target=lint --projects=app-web

      - name: Run Unit Tests
        # `--code-coverage` no es un flag válido de vitest/dotnet (vitest usa `--coverage`).
        # Se corre el target `test` (vitest run); la cobertura se gestiona con test:coverage.
        run: npx nx run-many --target=test --projects=app-web

      - name: Build Application (Vite)
        run: npx nx run-many --target=build --projects=app-web

  # 2. Advanced Security Analysis (CodeQL)
  codeql:
    name: CodeQL Static Security Scan
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: 'javascript-typescript'

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3