pr.yml

# This workflow will:
#   1. Do a clean installation of node dependencies
#   2. Run unit tests
#   3. Build the package
#   4. Scan push/PRs for leaked credentials using TruffleHog

name: PR workflow

on:
  push:
    branches: ['main']
  pull_request:
    branches: ['main']

jobs:
  build:
    name: Setup & build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the repo
        uses: actions/checkout@v3

      - name: Read .nvmrc
        run: echo "##[set-output name=NVMRC;]$(cat .nvmrc)"
        id: nvm

      - name: Use Node version from .nvmrc
        uses: actions/setup-node@v3
        with:
          node-version: ${{ steps.nvm.outputs.NVMRC }}

      - name: Install dependencies
        uses: pnpm/action-setup@v2
        with:
          version: 8
          run_install: true

      - name: Build the package
        run: pnpm run build

  run-unit-tests:
    name: Test on Node ${{ matrix.node_version }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [16, 18] # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
    steps:
      - uses: actions/checkout@v3
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v3
        with:
          node-version: ${{ matrix.node-version }}

      - name: Install dependencies
        uses: pnpm/action-setup@v2
        with:
          version: 8
          run_install: true

      - name: Run unit tests (with experimental VM modules)
        run: pnpm run test

  trufflehog:
    name: TruffleHog
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: TruffleHog OSS
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          head: HEAD
          extra_args: --debug --only-verified