quality-checks.yml

name: Quality Checks

on:
  workflow_call:
    secrets:
      SONAR_TOKEN:
        required: false
    inputs:
      install_java:
        type: boolean
        description: "If true, the action will install java into the runner, separately from ASDF."
        default: false
        required: false
      run_sonar:
        type: boolean
        description: Toggle to run sonar code analyis on this repository.
        default: true
        required: false
      asdfVersion:
        type: string
        required: true
      reinstall_poetry:
        type: boolean
        description: Toggle to reinstall poetry on top of python version installed by asdf.
        default: false

jobs:
  quality_checks:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165
        if: ${{ inputs.install_java }}
        with:
          java-version: "21"
          distribution: "corretto"

      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
        with:
          ref: ${{ env.BRANCH_NAME }}
          fetch-depth: 0

      # Must be done before anything installs, or it will check dependencies for secrets too.
      - name: Ensure .gitallowed exists, for secret scanning
        run: |
          if [ ! -f ".gitallowed" ]; then
            echo "Creating empty .gitallowed file"
            touch .gitallowed
            fi
          echo "./nhsd-rules-deny.txt:10" >> .gitallowed
          echo "Allowing the following regex patterns:"
          cat .gitallowed

      - name: Install git-secrets
        run: |
          sudo apt-get update
          sudo apt-get install -y git curl
          git clone https://github.com/awslabs/git-secrets.git /tmp/git-secrets
          cd /tmp/git-secrets
          sudo make install

      - name: Download regex patterns
        run: |
          curl -L https://raw.githubusercontent.com/NHSDigital/software-engineering-quality-framework/main/tools/nhsd-git-secrets/nhsd-rules-deny.txt -o nhsd-rules-deny.txt

      - name: Configure git-secrets
        run: |
          git-secrets --register-aws
          git-secrets --add-provider -- cat nhsd-rules-deny.txt

      - name: Run secrets scan
        run: |
          git-secrets --scan-history .

      # using git commit sha for version of action to ensure we have stable version
      - name: Install asdf
        uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
        with:
          asdf_version: ${{ inputs.asdfVersion }}

      - name: Cache asdf
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
        with:
          path: |
            ~/.asdf
          key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}-${{ inputs.asdfVersion }}
          restore-keys: |
            ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}-${{ inputs.asdfVersion }}

      - name: Install asdf dependencies in .tool-versions
        uses: asdf-vm/actions/install@1902764435ca0dd2f3388eea723a4f92a4eb8302
        with:
          asdf_version: ${{ inputs.asdfVersion }}
        env:
          PYTHON_CONFIGURE_OPTS: --enable-shared

      - name: Reinstall poetry
        if: ${{ inputs.reinstall_poetry }}
        run: |
          poetry_tool_version=$(cat .tool-versions | grep poetry)
          poetry_version=${poetry_tool_version//"poetry "}
          asdf uninstall poetry "$poetry_version"
          asdf install poetry

      - name: Setting up .npmrc
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
          echo "@nhsdigital:registry=https://npm.pkg.github.com" >> ~/.npmrc

      - name: make install
        run: |
          make install

      - name: Check if project uses Poetry
        id: check_poetry
        run: |
          if [ -f "pyproject.toml" ] && grep -q '\[tool.poetry\]' "pyproject.toml"; then
            echo "****************"
            echo "Project uses poetry"
            echo "****************"
            echo "uses_poetry=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not use poetry"
            echo "****************"
            echo "uses_poetry=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Check if project uses Java
        id: check_java
        run: |
          if [ -f pom.xml ]; then
            echo "****************"
            echo "Detected a Java project"
            echo "****************"
            echo "uses_java=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not use Java"
            echo "****************"
            echo "uses_java=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Check for SAM templates
        id: check_sam_templates
        run: |
          if [ -d "SAMtemplates" ]; then
            echo "****************"
            echo "Project has SAM templates"
            echo "****************"
            echo "sam_exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not have SAM templates"
            echo "****************"
            echo "sam_exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Check for cloudformation templates
        id: check_cf_templates
        run: |
          if [ -d "cloudformation" ]; then
            echo "****************"
            echo "Project has cloudformation templates"
            echo "****************"
            echo "cf_exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not have cloudformation templates"
            echo "****************"
            echo "cf_exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Check for cdk
        id: check_cdk
        run: |
          if [ -d "packages/cdk" ]; then
            echo "****************"
            echo "Project has cdk"
            echo "****************"
            echo "cdk_exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not have cdk"
            echo "****************"
            echo "cdk_exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Check licenses (Makefile)
        run: |
          make check-licenses

      - name: Run code lint
        run: make lint

      - name: actionlint
        uses: raven-actions/actionlint@3a24062651993d40fed1019b58ac6fbdfbf276cc

      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
        with:
          ignore_paths: >-
            *test*
            .venv
            node_modules
            .git

      - name: Run cfn-lint
        if: steps.check_sam_templates.outputs.sam_exists == 'true' || steps.check_cf_templates.outputs.cf_exists == 'true'
        run: |
          pip install cfn-lint
          cfn-lint -I "cloudformation/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'
          cfn-lint -I "SAMtemplates/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'

      - name: Run unit tests
        run: make test

      - name: Run cdk-synth
        if: steps.check_cdk.outputs.cdk_exists == 'true'
        run: |
          make cdk-synth

      - name: Install AWS SAM CLI
        if: steps.check_sam_templates.outputs.sam_exists == 'true'
        run: |
          pip install aws-sam-cli

      - name: Init cfn-guard
        run: |
          #!/usr/bin/env bash
          set -eou pipefail

          rm -rf /tmp/ruleset
          rm -rf cfn_guard_output

          wget -O /tmp/ruleset.zip https://github.com/aws-cloudformation/aws-guard-rules-registry/releases/download/1.0.2/ruleset-build-v1.0.2.zip >/dev/null 2>&1
          unzip /tmp/ruleset.zip -d /tmp/ruleset/ >/dev/null 2>&1

          curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/aws-cloudformation/cloudformation-guard/main/install-guard.sh | sh >/dev/null 2>&1

          mkdir -p cfn_guard_output

      - name: Run cfn-guard script for sam templates
        if: steps.check_sam_templates.outputs.sam_exists == 'true'
        run: |
          #!/usr/bin/env bash
          set -eou pipefail

          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
          for ruleset in "${rulesets[@]}"
          do
            while IFS= read -r -d '' file
            do
              echo "checking SAM template $file with ruleset $ruleset"
              mkdir -p "$(dirname cfn_guard_output/"$file")"

              # Transform the SAM template to CloudFormation and then run through cfn-guard
              SAM_OUTPUT=$(sam validate -t "$file" --region eu-west-2 --debug 2>&1 | \
                  grep -Pazo '(?s)AWSTemplateFormatVersion.*\n\/' | tr -d '\0')
              echo "${SAM_OUTPUT::-1}" | ~/.guard/bin/cfn-guard validate \
                  --rules "/tmp/ruleset/output/$ruleset.guard" \
                  --show-summary fail \
                  > "cfn_guard_output/${file}_${ruleset}.txt"

            done < <(find ./SAMtemplates -name '*.y*ml' -print0)
          done

      - name: Run cfn-guard script for cloudformation templates
        if: steps.check_cf_templates.outputs.cf_exists == 'true'
        run: |
          #!/usr/bin/env bash

          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
          for ruleset in "${rulesets[@]}"
          do
            echo "Checking all templates in cloudformation folder with ruleset $ruleset"

            ~/.guard/bin/cfn-guard validate \
                --data cloudformation \
                    --rules "/tmp/ruleset/output/$ruleset.guard" \
                --show-summary fail \
                > "cfn_guard_output/cloudformation_$ruleset.txt"
          done

      - name: Run cfn-guard script for cdk templates
        if: steps.check_cdk.outputs.cdk_exists == 'true'
        run: |
          #!/usr/bin/env bash

          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
          for ruleset in "${rulesets[@]}"
          do
            echo "Checking all templates in cdk.out folder with ruleset $ruleset"

            ~/.guard/bin/cfn-guard validate \
                --data cdk.out \
                    --rules "/tmp/ruleset/output/$ruleset.guard" \
                --show-summary fail \
                > "cfn_guard_output/cdk.out_$ruleset.txt"
          done

      - name: Download terraform plans
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
        with:
          pattern: "*_terraform_plan"
          path: terraform_plans/
          merge-multiple: true

      - name: Check terraform plans exist
        id: check_terraform_plans
        run: |
          if [ ! -d terraform_plans ]; then
            echo "Terraform plans not present."
            echo "terraform_plans_exist=false" >> "$GITHUB_OUTPUT"
          else
            echo "Terraform plans present:"
            ls -l terraform_plans/
            echo "terraform_plans_exist=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Run cfn-guard script for terraform plans
        if: steps.check_terraform_plans.outputs.terraform_plans_exist == 'true'
        run: |
          #!/usr/bin/env bash

          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
          for ruleset in "${rulesets[@]}"
          do
            echo "Checking terraform plans with ruleset $ruleset"

            ~/.guard/bin/cfn-guard validate \
                --data terraform_plans \
                    --rules "/tmp/ruleset/output/$ruleset.guard" \
                --show-summary fail \
                > "cfn_guard_output/terraform_plans_$ruleset.txt"
          done

      - name: Show cfn-guard output
        if: failure()
        run: find cfn_guard_output -type f -print0 | xargs -0 cat

      - name: Upload cfn_guard_output
        if: failure()
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
        with:
          name: cfn_guard_output
          path: cfn_guard_output

      - name: Generate and check SBOMs
        uses: NHSDigital/eps-action-sbom@36d76330ce9ea0775273c68da8384db1c0dba158

      - name: "check is SONAR_TOKEN exists"
        env:
          super_secret: ${{ secrets.SONAR_TOKEN }}
        if: ${{ env.super_secret != '' && inputs.run_sonar == true }}
        run: echo "SONAR_TOKEN_EXISTS=true" >> "$GITHUB_ENV"

      - name: Run SonarQube analysis
        if: ${{ steps.check_java.outputs.uses_java == 'true' && env.SONAR_TOKEN_EXISTS == 'true' }}
        run: mvn sonar:sonar -Dsonar.login=${{ secrets.SONAR_TOKEN }}

      - name: SonarCloud Scan
        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602
        if: ${{ steps.check_java.outputs.uses_java == 'false' && env.SONAR_TOKEN_EXISTS == 'true' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}