Regroups docker-sast and docker-sbom actions to run on a published Docker image.

Runs various checks for Kotlin code (e.g. static analysis, license check, tests, etc.). Can also build and push docker images.

Runs various checks for PHP code (e.g. phpcs, psalm) and optional frontend code (e.g. eslint, mocha).

Runs various checks for PHP code (e.g. phpcs, psalm).

Regroups psalm-taint-analysis and composer-sbom actions.

Runs various checks for Python repos that uses Pipenv (e.g. unit tests, type checking, code style, etc.).

Wraps CodeQL actions.

Runs various checks for JS code (e.g. eslint, stylelint, tests, etc.). Can also build and push docker images.

Resolves common application metadata like the application version or whether it is publishable (by our standards).

Publishes the JaCoCo report as a comment in the Pull Request.

Pushes a whole workflow result to a Slack webhook.

Downloads asdf-vm with cache. Initialize JAVA_HOME if java is specified in .tool-version.

Scans commits for leaked secrets. By default, pull request events will only scan new commits and push events will scan all commits.

Builds a container image and optionally push it. Labels and tags will be configured as per the OCI standards.

Resolves docker metadata such as tags and OCI labels.

Utilizes Dockle to generate a SARIF report. The report is archived and uploaded to Defect Dojo.

Utilizes Tern to generate a SBOM. This SBOM will then be archived and uploaded to Dependency-Track.

Runs Hadolint Dockerfile linting tool.

Runs our OpenApi-SDK gradle tasks to generate and publish a SDK. See https://github.com/kronostechnologies/standards/tree/master/gradle/openapi-sdk.

Runs a gradle task expecting JaCoCo reports to be produced. The exported reports will follow naming conventions detailed by our ADRs (https://confluence.equisoft.com/display/HRMI/ADR).

Runs a gradle task expecting JUnit reports to be produced. The exported reports will follow naming conventions detailed by our ADRs (https://confluence.equisoft.com/display/HRMI/ADR).

Checks Gradle dependencies licenses on the project. This action requires the global-conventions plugin to be installed.

Utilizes CycloneDX to generate a SBOM. This SBOM will then be archived and uploaded to Dependency-Track.

Runs GoKart to generate a SAST report of your codebase. Results are published to DefectDojo.

Install dependencies with composer (composer install)

Utilizes cyclonedx-php-composer to generate a SBOM. This SBOM will then be archived and uploaded to Dependency-Track.

Setup PHP with extensions.

Lint PHP with PHP_CodeSniffer

Runs PHPUnit and outputs a JUnit report, and a Clover report for coverage.

Runs psalm

Runs psalm with --taint-analysis and upload SARIF file artifact.

Install Python dependencies with Pipenv.

Utilizes cyclonedx-python to generate a SBOM. This SBOM will then be archived and uploaded to Dependency-Track. Prerequisite: pipenv install -d cyclonedx-bom.

Resolves common application metadata like the application version or whether it is publishable (by our standards).

Runs a yarn task expecting eslint reports to be produced. The exported reports will follow naming conventions detailed by our ADRs (https://confluence.equisoft.com/display/HRMI/ADR).
A report named build/eslint/junit.xml is expected under all circumstances.

Install Yarn dependencies with Yarn. By default, the action will use a rolling cache key to prevent the cache size from snowballing.

Runs a yarn task expecting jest reports and coverage data to be produced. The reports will follow naming conventions detailed by our ADRs (https://confluence.equisoft.com/display/HRMI/ADR).
Report named build/jest/junit.xml with build/jest/coverage/clover.xml are expected under all circumstances.

Runs a yarn task expecting mocha reports and coverage data to be produced. The reports will follow naming conventions detailed by our ADRs (https://confluence.equisoft.com/display/HRMI/ADR).
Report named build/mocha/junit.xml with build/mocha/coverage/clover.xml are expected under all circumstances.

Login to any NPM Registry with yarn.

Runs a yarn task expecting stylelint reports to be produced. The exported reports will follow naming conventions detailed by our ADRs (https://confluence.equisoft.com/display/HRMI/ADR).
A report named build/stylelint/junit.xml is expected under all circumstances.