on-pullrequest-or-push.yml

# SPDX-License-Identifier: Apache-2.0
# Licensed to the Ed-Fi Alliance under one or more agreements.
# The Ed-Fi Alliance licenses this file to you under the Apache License, Version 2.0.
# See the LICENSE and NOTICES files in the project root for more information.

name: On Pull Request or Push

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
    paths:
      - "**/*.ps1"
      - "**/*.psm1"
      - "**/*.cs"
      - "**/*.csproj"
      - ".github/**/*.yml"
  workflow_dispatch:

permissions: read-all

env:
  DB_PASS: ${{ secrets.DB_PASS }}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  run-ps-lint:
     name: PowerShell Linter
     permissions:
        actions: read
        contents: read
        security-events: write
     uses: Ed-Fi-Alliance-OSS/Ed-Fi-Actions/.github/workflows/powershell-analyzer.yml@main
  scan-actions-bidi:
    name: Scan Actions, scan all files for BIDI Trojan Attacks
    uses: ed-fi-alliance-oss/ed-fi-actions/.github/workflows/repository-scanner.yml@main
    with:
      config-file-path: ./.github/workflows/bidi-config.json

  build-and-test:
    name: Build and Test
    runs-on: ubuntu-latest

    services:
      mssql:
        image: mcr.microsoft.com/mssql/server:2019-latest
        env:
          MSSQL_SA_PASSWORD: ${{ env.DB_PASS }}
          ACCEPT_EULA: 'Y'
        ports:
          - 1433:1433

    defaults:
      run:
        shell: pwsh
    steps:
      - name: Checkout the Repo
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Build
        run: ./build.ps1 -Command Build -Configuration Release

      - name: Run Unit Tests
        if: success()
        run: ./build.ps1 -Command UnitTest -Configuration Release  -Report True

      - name: Integration Tests
        run: ./build.ps1 -Command IntegrationTest -Configuration Release  -Report True
        shell: pwsh
        env:
          ConnectionStrings__defaultConnection: "Server=localhost,1433;Initial Catalog=EdFi_DataImport_Test;User Id=sa;Password=${{ env.DB_PASS }};Trusted_Connection=False;TrustServerCertificate=True;"
          PythonExecutableLocation: "/usr/bin/python"

      - name: Upload Results as Workflow Artifact
        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
        with:
          name: csharp-tests
          path: "**/*.trx"
          retention-days: 5

  code-analysis:
    name: Code Analysis
    runs-on: ubuntu-latest
    permissions:
        security-events: write
    defaults:
        run:
            shell: pwsh
    steps:
      - name: Checkout the Repo
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Dependency Review ("Dependabot on PR")
        if: github.event_name == 'pull_request'
        uses: actions/dependency-review-action@9129d7d40b8c12c1ed0f60400d00c92d437adcce # v4.1.3

      - name: Initialize CodeQL
        if: success()
        uses: github/codeql-action/init@cf7e9f23492505046de9a37830c3711dd0f25bb3 # v2.16.2
        with:
          languages: csharp

      - name: Rebuild for CodeQL
        run: ./build.ps1 Build -Configuration Release

      - name: Perform CodeQL Analysis
        if: success()
        uses: github/codeql-action/analyze@cf7e9f23492505046de9a37830c3711dd0f25bb3 # v2.16.2