develop-func-ci.yml

name: CI_AutoMerge_Dependabot

on:
  pull_request:
    paths-ignore: # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet
      - '**/README.md'
      - '**/dependabot.yml'
      - 'docs/*'
      - '.vscode/*'
    branches:
      - develop
      - main

jobs:
  # Running the integration tests against the Docker container requires temporarily
  # setting "authLevel": "anonymous" in the function.json files (see README), because
  # the container has no AzureWebJobsStorage and so cannot validate function keys.
  # Committing that would leave the deployed endpoints reachable without a key.
  # There is a matching .husky/pre-commit guard, but hooks are skippable with
  # --no-verify and are absent in a fresh clone until `npm install` has run.
  check-auth-level:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout GitHub Action'
        uses: actions/checkout@v7

      - name: 'Reject authLevel anonymous in function.json'
        run: |
          if grep -il '"authLevel"[[:space:]]*:[[:space:]]*"anonymous"' */function.json > /tmp/hits; then
            echo "::error::function.json committed with authLevel anonymous - the deployed endpoint would need no function key"
            echo "Offending files:"
            cat /tmp/hits
            echo ""
            echo "Restore with:  git checkout -- '*/function.json'"
            exit 1
          fi
          echo "OK - all function.json files require a function key."

  build-test-node:
    runs-on: ubuntu-latest
    steps:
      - name: 'Install libxml2-utils'
        run: |
          sudo apt-get update && \
          sudo apt-get install libxml2-utils

      - name: 'Checkout GitHub Action'
        uses: actions/checkout@v7

      - name: 'Setup Node Environment'
        uses: actions/setup-node@v7
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: 'Install Dependencies with Npm'
        run: |
          npm i -g npm@^10
          npm ci

      # Runs before the unit tests because it catches a class they cannot: a source file
      # importing a package that is not installed. No unit test imports utils.js - it
      # pulls in Redis - so a tree where utils.js and package.json disagree about the XML
      # library still reports every test passing.
      - name: 'Lint'
        run: npx eslint .

      - name: 'Run unit tests'
        run: npm run unit:test

  build-docker:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout GitHub Action'
        uses: actions/checkout@v7

      - name: 'Build Docker Image'
        run: |
          docker build . -t validator-local:latest

  automerge:
    needs: [check-auth-level, build-test-node, build-docker]
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: write
    steps:
      - uses: fastify/github-action-merge-dependabot@v3.15.0
        with:
          github-token: ${{secrets.GITHUB_TOKEN}}