pr.yml

name: 'safe-pr-build-test'
on:
  pull_request_target:
    types: [labeled]

jobs:
  build: # make sure build/ci work properly
    runs-on: ubuntu-latest
    # Only run on labeled PRs to avoid leaking secrets
    if: contains(github.event.pull_request.labels.*.name, 'safe-to-test')
    env:
      MAYHEM_TOKEN: ${{ secrets.MAYHEM_TOKEN }}
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          # fetch entire history to compute diffs between jobs
          fetch-depth: 0
      - run: |
          npm install
      - run: |
          npm run all
  test: # make sure the action works on a clean machine without building
    runs-on: ubuntu-latest
    # Only run on labeled PRs to avoid leaking secrets
    if: contains(github.event.pull_request.labels.*.name, 'safe-to-test')
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          # fetch entire history to compute diffs between jobs
          fetch-depth: 0

      - uses: ./
        continue-on-error: true
        with:
          mayhem-token: ${{ secrets.MAYHEM_TOKEN }}
          api-url: https://demo-api.mayhem.security/api/v3
          api-spec: https://demo-api.mayhem.security/api/v3/openapi.json
          html-report: mapi.html
          run-args: |
            --warnaserror
            --junit
            junit.xml
      - name: Archive HTML report
        uses: actions/upload-artifact@v2
        with:
          name: mapi-report
          path: mapi.html
      - name: Archive JUnit results
        uses: actions/upload-artifact@v2
        with:
          name: mapi-junit
          path: junit.xml