Code Quality

jobs:
  lint:
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"
      # Detects changed files and picks the right linters automatically.
      - name: lint
        uses: "collabops/lint@v1"

jobs:
  lint:
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"
      - name: lint-typed
        uses: "collabops/lint@v1"
        with:
          # enable is an allowlist (only the listed ones). Comma-separated, uppercase.
          enable: "TYPESCRIPT,YAML,DOCKERFILE"
          # disable is a denylist. Combinable with enable.
          disable: "SPELL,COPYPASTE"

jobs:
  lint-fix:
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"
      - name: lint-with-autofix
        uses: "collabops/lint@v1"
        with:
          enable: "TYPESCRIPT,JAVASCRIPT"
          # Formatters / fixable linters write changes back to disk.
          apply-fixes: "true"
      # Hand the fixed tree off to another Job in the same workflow.
      - name: upload-fixes
        uses: "collabops/upload-artifact@v2"
        with:
          name: lint-fixes
          path: .

jobs:
  sast:
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"
      # Default config: "auto" — language detection picks a standard ruleset.
      - name: sast-scan
        uses: "collabops/sast-scan@v1"

jobs:
  sast:
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"
      - name: sast-owasp
        uses: "collabops/sast-scan@v1"
        with:
          # Standard ruleset. Accepts a Semgrep registry slug, local path, or URL.
          config: p/owasp-top-ten
          # Fail the Job when any finding meets or exceeds this severity.
          severity: WARNING

# To preserve the report even on failure, split into a separate Job with if: "always()".
jobs:
  sast:
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"
      - name: sast-with-sarif
        uses: "collabops/sast-scan@v1"
        with:
          config: p/security-audit
          # Standard format consumable by security dashboards and review tools.
          output-format: sarif

  archive-sast-report:
    needs: [sast]
    # Always runs regardless of upstream success/failure — report is always collected.
    if: "always()"
    steps:
      - name: archive-sarif
        uses: "collabops/upload-artifact@v2"
        with:
          name: sast-report
          path: semgrep-results.sarif

jobs:
  secret-scan:
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"
          # Secret scanning should cover the full history.
          fetch-depth: "0"
      - name: secret-detect
        uses: "collabops/secret-detect@v1"

# Split archival into its own Job so the report survives a failed scan.
jobs:
  secret-scan:
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"
          fetch-depth: "0"
      - name: secret-detect-with-rules
        uses: "collabops/secret-detect@v1"
        with:
          # Use the in-repo ruleset when one exists.
          config: .gitleaks.toml
          report-format: sarif
          report-path: /workspace/source/gitleaks-report.sarif

  archive-secret-report:
    needs: [secret-scan]
    if: "always()"
    steps:
      - name: archive-report
        uses: "collabops/upload-artifact@v2"
        with:
          name: gitleaks-report
          path: gitleaks-report.sarif

jobs:
  quality:
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"
      # Uploads the analysis to an external SonarQube server. Server URL/token come from workspace settings.
      - name: sonar-scan
        uses: "collabops/sonar-scan@v1"
        with:
          # SonarQube server URL — register SONAR_HOST_URL in workspace variables and reference it.
          sonar-host-url: ${{ vars.SONAR_HOST_URL }}
          # Analysis token — store it in secrets (never inline plaintext).
          sonar-token: ${{ secrets.SONAR_TOKEN }}
          # Project key created on the SonarQube server.
          project-key: "<workspace>-<repository>"

# To use it as a CR merge gate, combine the change_request trigger with qualitygate.wait.
jobs:
  quality:
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"
      - name: sonar-scan
        uses: "collabops/sonar-scan@v1"
        with:
          sonar-host-url: ${{ vars.SONAR_HOST_URL }}
          sonar-token: ${{ secrets.SONAR_TOKEN }}
          project-key: "<workspace>-<repository>"
          # Wait for the server-side Quality Gate result and fail the step on failure to block the merge.
          # (Only meaningful when a Quality Gate is configured for the project on the server.)
          quality-gate-wait: true

jobs:
  quality:
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"
      - name: sonar-scan
        uses: "collabops/sonar-scan@v1"
        with:
          sonar-host-url: ${{ vars.SONAR_HOST_URL }}
          sonar-token: ${{ secrets.SONAR_TOKEN }}
          project-key: "<workspace>-<repository>"
          # Source path to analyze (relative to working-directory).
          sources: "src"
          # Pass extra -D options through — multiple separated by spaces.
          extra-args: "-Dsonar.exclusions=**/*.test.ts -Dsonar.sourceEncoding=UTF-8"

- name: sbom
  uses: "collabops/sbom@v1"
  with:
    # pick any value from the table above (default: cyclonedx-json)
    format: spdx-json

jobs:
  sbom:
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"
      # Default: CycloneDX JSON of the source tree -> /workspace/source/sbom.json
      - name: sbom
        uses: "collabops/sbom@v1"

# SBOM generation only writes the file; chain upload-artifact to preserve it.
jobs:
  sbom:
    steps:
      - name: checkout
        uses: "collabops/checkout@v2"
        with:
          repo-url: "https://<collabops-host>/<workspace>/<repository>.git"
      - name: sbom
        uses: "collabops/sbom@v1"
        with:
          # cyclonedx-json | spdx-json | cyclonedx-xml | spdx-tag-value | syft-json
          format: spdx-json
          # dir:<path> for the source tree, or registry:<image> for a built image
          scan-target: dir:/workspace/source
      # SBOM writes /workspace/source/sbom.json - keep it as an artifact.
      - name: upload-sbom
        uses: "collabops/upload-artifact@v2"
        with:
          name: sbom
          path: sbom.json

# Scan a container image's installed packages instead of the source tree.
# No checkout needed — syft pulls and analyzes the image directly.
jobs:
  sbom:
    steps:
      - name: sbom
        uses: "collabops/sbom@v1"
        with:
          scan-target: "registry:my-registry.example.com/app:1.2.3"
      - name: upload-sbom
        uses: "collabops/upload-artifact@v2"
        with:
          name: sbom
          path: sbom.json