quality-checks.yml

name: Quality Checks

on:
  workflow_call:
    secrets:
      SONAR_TOKEN:
        required: false
    inputs:
      install_java:
        type: boolean
        description: "If true, the action will install java into the runner, separately from ASDF."
        default: false
        required: false
      run_sonar:
        type: boolean
        description: Toggle to run sonar code analyis on this repository.
        default: true
        required: false
      asdfVersion:
        type: string
        required: true
      reinstall_poetry:
        type: boolean
        description: Toggle to reinstall poetry on top of python version installed by asdf.
        default: false

jobs:
  quality_checks:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e
        if: ${{ inputs.install_java }}
        with:
          java-version: "21"
          distribution: "corretto"

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
        with:
          ref: ${{ env.BRANCH_NAME }}
          fetch-depth: 0

      # Must be done before anything installs, or it will check dependencies for secrets too.
      - name: Ensure .gitallowed exists, for secret scanning
        run: |
          if [ ! -f ".gitallowed" ]; then
            echo "Creating empty .gitallowed file"
            touch .gitallowed
            fi
          echo "./nhsd-rules-deny.txt:10" >> .gitallowed
          echo "Allowing the following regex patterns:"
          cat .gitallowed

      - name: Install git-secrets
        run: |
          sudo apt-get update
          sudo apt-get install -y git curl
          git clone https://github.com/awslabs/git-secrets.git /tmp/git-secrets
          cd /tmp/git-secrets
          sudo make install

      - name: Download regex patterns
        run: |
          curl -L https://raw.githubusercontent.com/NHSDigital/software-engineering-quality-framework/main/tools/nhsd-git-secrets/nhsd-rules-deny.txt -o nhsd-rules-deny.txt

      - name: Configure git-secrets
        run: |
          git-secrets --register-aws
          git-secrets --add-provider -- cat nhsd-rules-deny.txt

      - name: Run secrets scan
        run: |
          git-secrets --scan-history .

      # using git commit sha for version of action to ensure we have stable version
      - name: Install asdf
        uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47
        with:
          asdf_version: ${{ inputs.asdfVersion }}

      - name: Cache asdf
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: |
            ~/.asdf
          key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}-${{ inputs.asdfVersion }}
          restore-keys: |
            ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}-${{ inputs.asdfVersion }}

      - name: Install asdf dependencies in .tool-versions
        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47
        with:
          asdf_version: ${{ inputs.asdfVersion }}
        env:
          PYTHON_CONFIGURE_OPTS: --enable-shared

      - name: Reinstall poetry
        if: ${{ inputs.reinstall_poetry }}
        run: |
          poetry_tool_version=$(cat .tool-versions | grep poetry)
          poetry_version=${poetry_tool_version//"poetry "}
          asdf uninstall poetry "$poetry_version"
          asdf install poetry

      - name: Setting up .npmrc
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
          echo "@nhsdigital:registry=https://npm.pkg.github.com" >> ~/.npmrc

      - name: Cache npm dependencies
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ./node_modules
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: make install
        run: |
          make install

      - name: Check language tools used and setup trivy config
        id: check_languages
        run: |
          if [ -f "pyproject.toml" ] && grep -q '\[tool.poetry\]' "pyproject.toml"; then
            echo "****************"
            echo "Detected a poetry project"
            echo "****************"
            echo "uses_poetry=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not use poetry"
            echo "****************"
            echo "uses_poetry=false" >> "$GITHUB_OUTPUT"
          fi
          if [ -f pom.xml ]; then
            echo "****************"
            echo "Detected a Java project"
            echo "****************"
            echo "uses_java=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not use Java"
            echo "****************"
            echo "uses_java=false" >> "$GITHUB_OUTPUT"
          fi
          if [ -f package-lock.json ]; then
            echo "****************"
            echo "Detected a Node.js project"
            echo "****************"
            echo "uses_node=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not use Node.js"
            echo "****************"
            echo "uses_node=false" >> "$GITHUB_OUTPUT"
          fi
          if [ -f src/go.sum ]; then
            echo "****************"
            echo "Detected a Go project"
            echo "****************"
            echo "uses_go=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not use Go"
            echo "****************"
            echo "uses_go=false" >> "$GITHUB_OUTPUT"
          fi
          touch trivy.yaml
      - name: Update trivy config to include dev dependencies
        uses: mikefarah/yq@065b200af9851db0d5132f50bc10b1406ea5c0a8
        with:
          cmd: yq -i '.pkg.include-dev-deps = true' 'trivy.yaml'
      - name: convert python dependencies to requirements.txt
        if: ${{ steps.check_languages.outputs.uses_poetry == 'true' }}
        run: |
          POETRY_VERSION=$(poetry --version | awk '{print $3}')

          if [[ "$(printf '%s\n' "2.0.0" "$POETRY_VERSION" "3.0.0" | sort -V | head -n1)" == "2.0.0" ]] \
            && [[ "$(printf '%s\n' "$POETRY_VERSION" "3.0.0" | sort -V | head -n1)" == "$POETRY_VERSION" ]]; then
              echo "Poetry version $POETRY_VERSION is >=2.0.0 and <3.0.0 - installing plugin-export"
              poetry self add poetry-plugin-export
          else
              echo "Poetry version $POETRY_VERSION is outside the required range so not installing plugin-export"
          fi
          poetry export -f requirements.txt --with dev --without-hashes --output=requirements.txt
      - name: download go dependencies
        if: ${{ steps.check_languages.outputs.uses_go == 'true' }}
        run: |
          cd src
          go mod vendor
      - name: Check licenses
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
        with:
          scan-type: "fs"
          scan-ref: "."
          severity: "CRITICAL,HIGH"
          scanners: "license"
          format: "table"
          output: "license_scan.txt"
          exit-code: "1"
          list-all-pkgs: "false"
          trivy-config: trivy.yaml
        env:
          VIRTUAL_ENV: "./.venv/"
      - name: remove requirements.txt
        if: ${{ steps.check_languages.outputs.uses_poetry == 'true' }}
        run: |
          rm -f requirements.txt
      - name: clean go dependencies
        if: ${{ steps.check_languages.outputs.uses_go == 'true' }}
        run: |
          cd src
          rm -rf vendor
      - name: Show license scan output
        if: always()
        run: |
          if [ -f license_scan.txt ]; then
            cat license_scan.txt
          fi
      - name: Run code lint
        run: make lint

      - name: actionlint
        uses: raven-actions/actionlint@963d4779ef039e217e5d0e6fd73ce9ab7764e493

      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
        with:
          ignore_paths: >-
            *test*
            .venv
            node_modules
            .git

      - name: Run unit tests
        run: make test

      - name: Generate SBOM
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
        with:
          scan-type: "fs"
          scan-ref: "."
          scanners: "vuln"
          format: "cyclonedx"
          output: "sbom.cdx.json"
          exit-code: "0"
          trivy-config: trivy.yaml
      - name: Upload sbom
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
        with:
          name: sbom.cdx.json
          path: sbom.cdx.json

      - name: Check python vulnerabilities
        if: ${{ steps.check_languages.outputs.uses_poetry == 'true' }}
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
        with:
          scan-type: "fs"
          skip-files: "**/package-lock.json,**/go.mod,**/pom.xml"
          scan-ref: "."
          severity: "CRITICAL,HIGH"
          scanners: "vuln"
          format: "table"
          output: "dependency_results_python.txt"
          exit-code: "1"
          trivy-config: trivy.yaml
      - name: Check node vulnerabilities
        if: ${{ steps.check_languages.outputs.uses_node == 'true' }}
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
        with:
          scan-type: "fs"
          skip-files: "**/poetry.lock,**/go.mod,**/pom.xml"
          scan-ref: "."
          severity: "CRITICAL,HIGH"
          scanners: "vuln"
          format: "table"
          output: "dependency_results_node.txt"
          exit-code: "1"
          trivy-config: trivy.yaml
      - name: Check go vulnerabilities
        if: ${{ steps.check_languages.outputs.uses_go == 'true' }}
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
        with:
          scan-type: "fs"
          skip-files: "**/poetry.lock,**/package-lock.json,**/pom.xml"
          scan-ref: "."
          severity: "CRITICAL,HIGH"
          scanners: "vuln"
          format: "table"
          output: "dependency_results_go.txt"
          exit-code: "1"
      - name: Check java vulnerabilities
        if: ${{ steps.check_languages.outputs.uses_java == 'true' }}
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
        with:
          scan-type: "fs"
          skip-files: "**/poetry.lock,**/package-lock.json,**/go.mod"
          scan-ref: "."
          severity: "CRITICAL,HIGH"
          scanners: "vuln"
          format: "table"
          output: "dependency_results_java.txt"
          exit-code: "1"
          trivy-config: trivy.yaml
      - name: Show vulnerability output
        if: always()
        run: |
          if [ -f dependency_results_python.txt ]; then
            cat dependency_results_python.txt
          fi
          if [ -f dependency_results_node.txt ]; then
            cat dependency_results_node.txt
          fi
          if [ -f dependency_results_java.txt ]; then
            cat dependency_results_java.txt
          fi
          if [ -f dependency_results_go.txt ]; then
            cat dependency_results_go.txt
          fi
      - name: "check is SONAR_TOKEN exists"
        env:
          super_secret: ${{ secrets.SONAR_TOKEN }}
        if: ${{ env.super_secret != '' && inputs.run_sonar == true }}
        run: echo "SONAR_TOKEN_EXISTS=true" >> "$GITHUB_ENV"

      - name: Run SonarQube analysis
        if: ${{ steps.check_languages.outputs.uses_java == 'true' && env.SONAR_TOKEN_EXISTS == 'true' }}
        run: mvn sonar:sonar -Dsonar.login=${{ secrets.SONAR_TOKEN }}

      - name: SonarCloud Scan
        uses: SonarSource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9
        if: ${{ steps.check_languages.outputs.uses_java == 'false' && env.SONAR_TOKEN_EXISTS == 'true' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  # CloudFormation validation (runs only if templates exist, ~3-5 minutes)
  IaC-validation:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
        with:
          ref: ${{ env.BRANCH_NAME }}
          fetch-depth: 0

      # using git commit sha for version of action to ensure we have stable version
      - name: Install asdf
        uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47
        with:
          asdf_version: ${{ inputs.asdfVersion }}

      - name: Cache asdf
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: |
            ~/.asdf
          key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}-${{ inputs.asdfVersion }}
          restore-keys: |
            ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}-${{ inputs.asdfVersion }}

      - name: Install asdf dependencies in .tool-versions
        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47
        with:
          asdf_version: ${{ inputs.asdfVersion }}
        env:
          PYTHON_CONFIGURE_OPTS: --enable-shared

      - name: Reinstall poetry
        if: ${{ inputs.reinstall_poetry }}
        run: |
          poetry_tool_version=$(cat .tool-versions | grep poetry)
          poetry_version=${poetry_tool_version//"poetry "}
          asdf uninstall poetry "$poetry_version"
          asdf install poetry

      - name: Check for SAM templates
        id: check_sam_templates
        run: |
          if [ -d "SAMtemplates" ]; then
            echo "****************"
            echo "Project has SAM templates"
            echo "****************"
            echo "sam_exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not have SAM templates"
            echo "****************"
            echo "sam_exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Check for cloudformation templates
        id: check_cf_templates
        run: |
          if [ -d "cloudformation" ]; then
            echo "****************"
            echo "Project has cloudformation templates"
            echo "****************"
            echo "cf_exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not have cloudformation templates"
            echo "****************"
            echo "cf_exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Check for cdk
        id: check_cdk
        run: |
          if [ -d "packages/cdk" ]; then
            echo "****************"
            echo "Project has cdk"
            echo "****************"
            echo "cdk_exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "****************"
            echo "Project does not have cdk"
            echo "****************"
            echo "cdk_exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Run cfn-lint
        if: steps.check_sam_templates.outputs.sam_exists == 'true' || steps.check_cf_templates.outputs.cf_exists == 'true'
        run: |
          pip install cfn-lint
          cfn-lint -I "cloudformation/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'
          cfn-lint -I "SAMtemplates/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'

      - name: Cache npm dependencies
        if: steps.check_cdk.outputs.cdk_exists == 'true'
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Setting up .npmrc
        if: steps.check_cdk.outputs.cdk_exists == 'true'
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
          echo "@nhsdigital:registry=https://npm.pkg.github.com" >> ~/.npmrc

      - name: make install NodeJS
        if: steps.check_cdk.outputs.cdk_exists == 'true'
        run: |
          make install-node && make compile

      - name: Run cdk-synth
        if: steps.check_cdk.outputs.cdk_exists == 'true'
        run: |
          make cdk-synth

      - name: Install AWS SAM CLI
        if: steps.check_sam_templates.outputs.sam_exists == 'true'
        run: |
          pip install aws-sam-cli

      - name: Init cfn-guard
        run: |
          #!/usr/bin/env bash
          set -eou pipefail

          rm -rf /tmp/ruleset
          rm -rf cfn_guard_output

          wget -O /tmp/ruleset.zip https://github.com/aws-cloudformation/aws-guard-rules-registry/releases/download/1.0.2/ruleset-build-v1.0.2.zip >/dev/null 2>&1
          unzip /tmp/ruleset.zip -d /tmp/ruleset/ >/dev/null 2>&1

          curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/aws-cloudformation/cloudformation-guard/main/install-guard.sh | sh >/dev/null 2>&1

          mkdir -p cfn_guard_output

      - name: Run cfn-guard script for sam templates
        if: steps.check_sam_templates.outputs.sam_exists == 'true'
        run: |
          #!/usr/bin/env bash
          set -eou pipefail

          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
          for ruleset in "${rulesets[@]}"
          do
            while IFS= read -r -d '' file
            do
              echo "checking SAM template $file with ruleset $ruleset"
              mkdir -p "$(dirname cfn_guard_output/"$file")"

              # Transform the SAM template to CloudFormation and then run through cfn-guard
              SAM_OUTPUT=$(sam validate -t "$file" --region eu-west-2 --debug 2>&1 | \
                  grep -Pazo '(?s)AWSTemplateFormatVersion.*\n\/' | tr -d '\0')
              echo "${SAM_OUTPUT::-1}" | ~/.guard/bin/cfn-guard validate \
                  --rules "/tmp/ruleset/output/$ruleset.guard" \
                  --show-summary fail \
                  > "cfn_guard_output/${file}_${ruleset}.txt"

            done < <(find ./SAMtemplates -name '*.y*ml' -print0)
          done

      - name: Run cfn-guard script for cloudformation templates
        if: steps.check_cf_templates.outputs.cf_exists == 'true'
        run: |
          #!/usr/bin/env bash

          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
          for ruleset in "${rulesets[@]}"
          do
            echo "Checking all templates in cloudformation folder with ruleset $ruleset"

            ~/.guard/bin/cfn-guard validate \
                --data cloudformation \
                    --rules "/tmp/ruleset/output/$ruleset.guard" \
                --show-summary fail \
                > "cfn_guard_output/cloudformation_$ruleset.txt"
          done

      - name: Run cfn-guard script for cdk templates
        if: steps.check_cdk.outputs.cdk_exists == 'true'
        run: |
          #!/usr/bin/env bash

          cdk_output_dir="cdk.out"
          if [ ! -d "$cdk_output_dir" ]; then
            cdk_output_dir="packages/cdk/cdk.out"
          fi

          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
          for ruleset in "${rulesets[@]}"
          do
            echo "Checking all templates in cdk.out folder with ruleset $ruleset"

            ~/.guard/bin/cfn-guard validate \
                --data "$cdk_output_dir" \
                    --rules "/tmp/ruleset/output/$ruleset.guard" \
                --show-summary fail \
                > "cfn_guard_output/cdk.out_$ruleset.txt"
          done

      - name: Download terraform plans
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
        with:
          pattern: "*_terraform_plan"
          path: terraform_plans/
          merge-multiple: true

      - name: Check terraform plans exist
        id: check_terraform_plans
        run: |
          if [ ! -d terraform_plans ]; then
            echo "Terraform plans not present."
            echo "terraform_plans_exist=false" >> "$GITHUB_OUTPUT"
          else
            echo "Terraform plans present:"
            ls -l terraform_plans/
            echo "terraform_plans_exist=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Run cfn-guard script for terraform plans
        if: steps.check_terraform_plans.outputs.terraform_plans_exist == 'true'
        run: |
          #!/usr/bin/env bash

          declare -a rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar")
          for ruleset in "${rulesets[@]}"
          do
            echo "Checking terraform plans with ruleset $ruleset"

            ~/.guard/bin/cfn-guard validate \
                --data terraform_plans \
                    --rules "/tmp/ruleset/output/$ruleset.guard" \
                --show-summary fail \
                > "cfn_guard_output/terraform_plans_$ruleset.txt"
          done

      - name: Show cfn-guard output
        if: failure()
        run: find cfn_guard_output -type f -print0 | xargs -0 cat

      - name: Upload cfn_guard_output
        if: failure()
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
        with:
          name: cfn_guard_output
          path: cfn_guard_output