ci.yml

name: CI
on:
  pull_request:
  workflow_dispatch:
  push:
    branches:
      - main
jobs:
  CI:
    runs-on: ubuntu-latest
    permissions:
      contents: read

      # These permissions are required by guardian/actions-riff-raff...
      id-token: write # ...to exchange an OIDC JWT ID token for AWS credentials
      pull-requests: write #...to comment on PRs

    steps:
      - uses: actions/checkout@v4

      # Node is needed for CDK
      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'
          cache-dependency-path: 'cdk/package-lock.json'

      # Java is needed for the Scala Play app
      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          java-version: '11' # TODO read this from the `.java-version` file in the repository
          distribution: 'corretto'
      - run: ./scripts/ci

      - uses: guardian/actions-riff-raff@v4
        with:
          projectName: devx::prism
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          roleArn: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
          configPath: riff-raff.yaml # TODO switch to auto-generating this file
          contentDirectories: |
            cloudformation:
              - cdk/cdk.out
            prism:
              - target/prism.deb