build_validation_develop.yml

---
name: Build Validation

on: # yamllint disable-line rule:truthy
  pull_request:
    branches:
      - main
      - "feature/**"

# for each ref (branch/pr) run just the most recent,
# cancel other pending/running ones
concurrency:
  group: "${{ github.workflow }}-${{ github.head_ref }}"
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read # For paths-filter and super-linter
    env:
      # Report lint results through the job without publishing statuses or PR comments.
      MULTI_STATUS: "false"
      ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT: "false"
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          # Full git history is needed to get a proper list of
          # changed files within `super-linter`
          fetch-depth: 0
          persist-credentials: false

      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        with:
          filters: |
            terraform:
              # our Terraform uses more than just *.tf files, so need to check changes in the folder
              - '**/terraform/**/*'
            core:
              - 'core/**/*'
            core_version:
              - 'core/version.txt'
            docs:
              - 'docs/**/*'
            github_scripts:
              - '.github/scripts/**'
              - '.github/linters/actionlint.yml'
              - '.github/workflows/deploy_tre.yml'
              - '.github/workflows/deploy_tre_branch.yml'
              - '.github/workflows/clean_validation_envs.yml'
              - '.github/workflows/deploy_tre_reusable.yml'
              - '.github/workflows/pr_comment_bot.yml'
              - '.github/workflows/build_validation_develop.yml'
              - '.github/workflows/build_all_dockerfiles.yml'
              - '.devcontainer/Dockerfile'
              - '.devcontainer/scripts/porter-v1.sh'
              - 'devops/scripts/porter_build_bundle.sh'
              - '**/porter-build-context.env'
            ci_cleanup:
              - 'Makefile'
              - 'config_schema.json'
              - 'core/terraform/outputs.tf'
              - 'core/terraform/outputs.sh'
              - 'core/terraform/write_outputs.sh'
              - 'core/terraform/json-to-env.sh'
              - 'devops/scripts/load_env.sh'
              - 'devops/scripts/load_and_validate_env.sh'
              - 'core/terraform/scripts/letsencrypt.sh'
              - 'core/terraform/scripts/validate_certbot.sh'
              - 'devops/scripts/clean_ci_validation_envs.sh'
              - 'devops/scripts/storage_enable_public_access.sh'
              - 'devops/scripts/bash_trap_helper.sh'
              - 'devops/scripts/terraform_init.sh'
              - 'devops/scripts/recover_bootstrap_lease.py'
              - 'devops/scripts/ci_environment_id.py'
              - 'devops/scripts/ci_cleanup_scope.py'
              - 'devops/scripts/ci_cleanup_activity.py'
              - 'devops/scripts/verify_deployment_lock.py'
              - 'devops/scripts/destroy_ci_ref_env.py'
              - 'devops/scripts/destroy_env_no_terraform.sh'
              - 'devops/scripts/validate_ci_cleanup.py'
              - 'devops/scripts/kv_add_network_exception.sh'
              - 'core/terraform/deploy.sh'
              - 'core/terraform/mgmt_storage_private_endpoint.sh'
              - 'devops/terraform/**'
              - '.github/actions/devcontainer_run_command/action.yml'
              - '.github/workflows/deploy_tre_reusable.yml'
              - '.github/workflows/deploy_tre_branch.yml'
              - '.github/workflows/pr_comment_bot.yml'
              - 'devops/tests/**'
              - 'templates/shared_services/sonatype-nexus-vm/scripts/**'
              - 'templates/shared_services/certs/**'
              - 'templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/terraform/**'
              - '.github/workflows/build_validation_develop.yml'
              - '.github/workflows/clean_validation_envs.yml'

            terraform_core:
              - core/**/terraform/**/*.tf

            terraform_workspaces:
              - templates/workspaces/**/terraform/**/*.tf

            terraform_shared_services:
              - templates/shared_services/**/terraform/**/*.tf

            terraform_workspace_services:
              - templates/workspace_services/**/terraform/**/*.tf

            workspace_templates:
              - templates/workspaces/base/porter.yaml
              - templates/workspaces/base/template_schema.json
              - templates/workspaces/unrestricted/porter.yaml
              - templates/workspaces/unrestricted/template_schema.json
              - templates/workspaces/airlock-import-review/porter.yaml
              - templates/workspaces/airlock-import-review/template_schema.json
              - tests/requirements.txt
              - tests/test_workspace_template_defaults.py
              - .github/workflows/build_validation_develop.yml

      - name: Set up Node.js for GitHub scripts
        if: ${{ steps.filter.outputs.github_scripts == 'true' }}
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "24"

      - name: Test GitHub scripts
        if: ${{ steps.filter.outputs.github_scripts == 'true' }}
        working-directory: .github/scripts
        run: |
          npm ci
          npm test -- --runInBand

      - name: Test deployment scripts
        if: ${{ steps.filter.outputs.ci_cleanup == 'true' }}
        run: python3 -m unittest discover -s devops/tests -v

      - name: Test core outputs in the development-container base
        if: ${{ steps.filter.outputs.ci_cleanup == 'true' }}
        # Bookworm provides jq 1.6; the hosted runner has a newer jq version.
        run: |
          docker run --rm --network none \
            --mount "type=bind,source=${PWD},target=/workspaces/tre,readonly" \
            --workdir /workspaces/tre --entrypoint /bin/bash \
            mcr.microsoft.com/vscode/devcontainers/python:dev-3.12-bookworm \
            -c 'jq --version; python3 -m unittest discover -s devops/tests -p test_core_outputs.py -v'

      - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
        if: ${{ steps.filter.outputs.terraform == 'true' }}
        with:
          terraform_version: "1.14.3"

      - name: Terraform format check
        if: ${{ steps.filter.outputs.terraform == 'true' }}
        run: terraform fmt -check -recursive

      # find all terraform folders and run validate to catch
      # configuration errors
      - name: Terraform validation
        if: ${{ steps.filter.outputs.terraform == 'true' }}
        run: |
          find . -type d -name 'terraform' -not -path '*cnab*' -print0 \
          | xargs -0 -I{} sh -c 'echo "***** Validating: {} *****"; \
          terraform -chdir={} init -backend=false; terraform -chdir={} validate'

      - name: "Stale version: core"
        if: ${{ steps.filter.outputs.core == 'true' &&
          steps.filter.outputs.core_version == 'false' }}
        run: echo "::error::Code update without version change" && exit 1

      - name: Lint code base
        # the slim image is 2GB smaller and we don't use the extra stuff
        # Moved this after the Terraform checks above due something similar to this issue:
        # https://github.com/github/super-linter/issues/2433
        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
        env:
          VALIDATE_ALL_CODEBASE: false
          DEFAULT_BRANCH: main
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VALIDATE_MARKDOWN: true
          VALIDATE_PYTHON_RUFF: true
          VALIDATE_PYTHON_RUFF_FORMAT: true
          PYTHON_RUFF_CONFIG_FILE: ../../pyproject.toml
          PYTHON_RUFF_FORMAT_CONFIG_FILE: ../../pyproject.toml
          VALIDATE_YAML: true
          VALIDATE_TERRAFORM_TFLINT: true
          VALIDATE_JAVA: true
          JAVA_FILE_NAME: checkstyle.xml
          VALIDATE_BASH: true
          VALIDATE_BASH_EXEC: true
          VALIDATE_GITHUB_ACTIONS: true
          VALIDATE_DOCKERFILE_HADOLINT: true
          VALIDATE_TSX: true
          VALIDATE_TYPESCRIPT_ES: true
          TYPESCRIPT_ES_CONFIG_FILE: ../../ui/app/eslint.config.js
          TSX_CONFIG_FILE: ../../ui/app/eslint.config.js

      - name: Set up Python for Bandit
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"
          cache: pip

      - name: Install Bandit
        run: pip install bandit==1.8.3

      - name: Run Bandit security checks
        run: bandit -ll -c pyproject.toml -r .

      - name: Docs validation
        if: ${{ steps.filter.outputs.docs == 'true' }}
        run: |
          pip install -r docs/requirements.txt
          mkdocs build --strict

      - name: Workspace template defaults
        if: ${{ steps.filter.outputs.workspace_templates == 'true' }}
        run: |
          pip install -r tests/requirements.txt
          python tests/test_workspace_template_defaults.py

      - name: Core Tags
        if: ${{ steps.filter.outputs.terraform_core == 'true' }}
        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
        env:
          VALIDATE_ALL_CODEBASE: false
          DEFAULT_BRANCH: main
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VALIDATE_TERRAFORM_TFLINT: true
          TERRAFORM_TFLINT_CONFIG_FILE: .tflint_core.hcl
          FILTER_REGEX_INCLUDE: "./core/.*"

      - name: Workspace Tags
        if: ${{ steps.filter.outputs.terraform_workspaces == 'true' }}
        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
        env:
          VALIDATE_ALL_CODEBASE: false
          DEFAULT_BRANCH: main
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VALIDATE_TERRAFORM_TFLINT: true
          TERRAFORM_TFLINT_CONFIG_FILE: .tflint_workspaces.hcl
          FILTER_REGEX_INCLUDE: "./templates/workspaces/.*"

      - name: Workspace Services Tags
        if: ${{ steps.filter.outputs.terraform_workspace_services == 'true' }}
        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
        env:
          VALIDATE_ALL_CODEBASE: false
          DEFAULT_BRANCH: main
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VALIDATE_TERRAFORM_TFLINT: true
          TERRAFORM_TFLINT_CONFIG_FILE: .tflint_workspace_services.hcl
          FILTER_REGEX_INCLUDE: "./templates/workspace_services/.*"
          FILTER_REGEX_EXCLUDE: ".*user_resource.*"

      - name: User Resources Tags
        if: ${{ steps.filter.outputs.terraform_workspace_services == 'true' }}
        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
        env:
          VALIDATE_ALL_CODEBASE: false
          DEFAULT_BRANCH: main
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VALIDATE_TERRAFORM_TFLINT: true
          TERRAFORM_TFLINT_CONFIG_FILE: .tflint_user_resources.hcl
          FILTER_REGEX_INCLUDE: "./templates/workspace_services/.*/user_resources/.*"

      - name: Shared Services Tags
        if: ${{ steps.filter.outputs.terraform_shared_services == 'true' }}
        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
        env:
          VALIDATE_ALL_CODEBASE: false
          DEFAULT_BRANCH: main
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VALIDATE_TERRAFORM_TFLINT: true
          TERRAFORM_TFLINT_CONFIG_FILE: .tflint_shared_services.hcl
          FILTER_REGEX_INCLUDE: "./templates/shared_services/.*"