build.yaml

# These workflows are copied from stardust-npm-scripts. Edit them there.
---
name: Lint, test and build
on: push

env:
  GCLOUD_PROJECT_NAME: um-cloud-production
  GCLOUD_PROJECT_ID: 72990522503

permissions:
  # Needed to clone the repo
  contents: read
  # Needed for Workload Identity
  id-token: write
  # Needed to pull docker images
  packages: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2

    - uses: google-github-actions/auth@v0
      with:
        workload_identity_provider: projects/${{ env.GCLOUD_PROJECT_ID }}/locations/global/workloadIdentityPools/github/providers/github-actions
        service_account: github-actions@${{ env.GCLOUD_PROJECT_NAME }}.iam.gserviceaccount.com

    - name: Get common secrets
      id: secrets
      uses: google-github-actions/get-secretmanager-secrets@v0
      with:
        secrets: |-
          github:${{ env.GCLOUD_PROJECT_NAME }}/github

    - name: NPM cache
      uses: actions/cache@v2
      with:
        path: ~/.npm
        key: npm-${{ hashFiles('**/package-lock.json') }}

    - uses: actions/setup-node@v2
      with:
        node-version: 16

    - run: npm ci
      env:
        GITHUB_TOKEN: ${{ fromJson(steps.secrets.outputs.github).token }} # Needed because we install private packages from npm.pkg.github.com

    - run: npm run build

    - run: npm run lint