on_push_pr_main.yml

name: Push & PR to the main branch

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  detect_changes:
    name: Detect repository changes
    runs-on: ubuntu-latest
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
    steps:
      - uses: actions/checkout@v4

      - uses: dorny/paths-filter@v2
        id: filter
        with:
          filters: |
            backend:
              - 'backend/**'
            frontend:
              - 'front/**'

  lint_frontend:
    name: Lint frontend
    needs: detect_changes
    if: ${{ needs.detect_changes.outputs.frontend == 'true' }}
    uses: ./.github/workflows/flow_front_lint.yml

  security_frontend:
    name: Run Snyk on the frontend
    runs-on: ubuntu-latest
    needs: detect_changes
    if: ${{ needs.detect_changes.outputs.frontend == 'true' }}
    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js 18
        uses: actions/setup-node@v4
        with:
          node-version: 18
          cache: "npm"
          cache-dependency-path: "./front"

      - name: Install dependencies
        run: npm ci
        working-directory: "./front"

      - name: Run Snyk
        uses: snyk/actions/node@0.4.0
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --file=front/package.json --sarif-file-output=snyk.sarif

      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: snyk.sarif

  lint_backend:
    name: Lint backend
    needs: detect_changes
    if: ${{ needs.detect_changes.outputs.backend == 'true' }}
    uses: ./.github/workflows/flow_backend_lint.yml

  security_backend:
    name: Run Snyk on the backend
    runs-on: ubuntu-latest
    needs: detect_changes
    if: ${{ needs.detect_changes.outputs.backend == 'true' }}
    steps:
      - uses: actions/checkout@v4

      - name: Run Snyk
        uses: snyk/actions/gradle-jdk17@0.4.0
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --file=backend/build.gradle.kts --all-sub-projects --sarif-file-output=snyk.sarif

      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: snyk.sarif

  build_push_backend:
    name: Build & push Docker image of the "${{ matrix.service }}" service
    needs: lint_backend
    uses: ./.github/workflows/flow_backend_build_push.yml
    strategy:
      matrix:
        service: [api_gateway, jobs, messaging, employer, notification, profile, recommendation]
    with:
      service-name: ${{ matrix.service }}
      push-image: ${{ github.event_name != 'pull_request' }}
      image-tags: |
        type=sha
        type=ref,event=branch
        type=edge,branch=main