code-analysis.yml

name: Code analysis

on:
  # Trigger analysis when pushing in master or pull requests, and when creating
  # a pull request.
  push:
    branches:
      - master
  pull_request:
      types: [opened, synchronize, reopened]

jobs:
  analysis:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
      with:
        # Disabling shallow clone is recommended for improving relevancy of reporting
        fetch-depth: 0
    - name: Detect Node version from .nvmrc
      id: node_version
      run: echo "::set-output name=nvmrc::$(cat .nvmrc)"

    - uses: actions/setup-node@v2
      with:
        node-version: ${{ steps.node_version.outputs.nvmrc }}

    - name: npm-ci
      run: npm ci

    - name: test 
      run: npm run coverage

    - name: Codecov Scan
      uses: codecov/codecov-action@v2
      with:
        token: ${{ secrets.CODECOV_TOKEN }} # not required for public repos
        files: ./coverage/clover.xml
        flags: unittests # optional
        verbose: true # optional (default = false)
      
    - name: SonarCloud Scan
      uses: sonarsource/sonarcloud-github-action@master
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v1
      with:
          languages: typeScript

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v1