test-workflow.yml

name: Reusable Code Linting Workflow

# This workflow is designed to be called from other repositories
on:
    workflow_call:
        inputs:
            node-version:
                description: "Node.js version to use"
                required: false
                type: string
                default: "18"

            working-directory:
                description: "Working directory for the project"
                required: false
                type: string
                default: "."

            environment:
                description: "Target environment (development, staging, production)"
                required: false
                type: string
                default: "development"

            lint-severity:
                description: "Minimum severity level for linting (error, warning, info)"
                required: false
                type: string
                default: "warning"

            run-security-audit:
                description: "Whether to run npm security audit"
                required: false
                type: boolean
                default: true

            package-manager:
                description: "Package manager to use (npm, yarn, pnpm)"
                required: false
                type: string
                default: "npm"

            eslint-config:
                description: "Path to custom ESLint config file"
                required: false
                type: string
                default: ""

        secrets:
            # Optional custom token if needed, otherwise uses default GITHUB_TOKEN
            ACCESS_TOKEN:
                required: false

            # Optional secrets for custom operations
            CUSTOM_SECRET:
                required: false

        outputs:
            lint-status:
                description: "Status of the linting job"
                value: ${{ jobs.code-linting.outputs.status }}

            security-status:
                description: "Status of the security audit"
                value: ${{ jobs.security-scan.outputs.status }}

# Environment variables
env:
    NODE_VERSION: ${{ inputs.node-version }}
    WORKING_DIR: ${{ inputs.working-directory }}
    ENVIRONMENT: ${{ inputs.environment }}

jobs:
    setup-validation:
        name: Validate Inputs
        runs-on: ubuntu-latest
        outputs:
            should-proceed: ${{ steps.validate.outputs.should-proceed }}
            package-manager: ${{ steps.validate.outputs.package-manager }}

        steps:
            - name: Validate workflow inputs
              id: validate
              run: |
                  echo "🔍 Validating workflow inputs..."
                  echo "Node Version: ${{ inputs.node-version }}"
                  echo "Working Directory: ${{ inputs.working-directory }}"
                  echo "Environment: ${{ inputs.environment }}"
                  echo "Lint Severity: ${{ inputs.lint-severity }}"
                  echo "Package Manager: ${{ inputs.package-manager }}"
                  echo "Run Security Audit: ${{ inputs.run-security-audit }}"

                  # Validate package manager
                  if [[ "${{ inputs.package-manager }}" =~ ^(npm|yarn|pnpm)$ ]]; then
                    echo "✅ Valid package manager"
                    echo "package-manager=${{ inputs.package-manager }}" >> $GITHUB_OUTPUT
                  else
                    echo "❌ Invalid package manager. Using npm as default."
                    echo "package-manager=npm" >> $GITHUB_OUTPUT
                  fi

                  echo "should-proceed=true" >> $GITHUB_OUTPUT
                  echo "✅ Validation complete"

    code-linting:
        name: Run Code Linting
        runs-on: ubuntu-latest
        needs: setup-validation
        if: needs.setup-validation.outputs.should-proceed == 'true'
        outputs:
            status: ${{ steps.lint.outcome }}

        steps:
            - name: Checkout calling repository
              uses: actions/checkout@v4
              with:
                  token: ${{ secrets.ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
                  fetch-depth: 0

            - name: Setup Node.js
              uses: actions/setup-node@v4
              with:
                  node-version: ${{ inputs.node-version }}
                  cache: ${{ needs.setup-validation.outputs.package-manager }}
                  cache-dependency-path: ${{ inputs.working-directory }}/package-lock.json

            - name: Cache dependencies
              uses: actions/cache@v3
              with:
                  path: |
                      ${{ inputs.working-directory }}/node_modules
                      ~/.npm
                      ~/.cache/yarn
                      ~/.cache/pnpm
                  key: ${{ runner.os }}-${{ needs.setup-validation.outputs.package-manager }}-${{ hashFiles(format('{0}/package-lock.json', inputs.working-directory)) }}
                  restore-keys: |
                      ${{ runner.os }}-${{ needs.setup-validation.outputs.package-manager }}-

            - name: Install dependencies
              working-directory: ${{ inputs.working-directory }}
              run: |
                  echo "📦 Installing dependencies using ${{ needs.setup-validation.outputs.package-manager }}..."

                  case "${{ needs.setup-validation.outputs.package-manager }}" in
                    npm)
                      npm ci
                      ;;
                    yarn)
                      yarn install --frozen-lockfile
                      ;;
                    pnpm)
                      pnpm install --frozen-lockfile
                      ;;
                  esac

            - name: Run ESLint
              id: lint
              working-directory: ${{ inputs.working-directory }}
              continue-on-error: true
              run: |
                  echo "🔍 Running ESLint with severity level: ${{ inputs.lint-severity }}"

                  ESLINT_CONFIG=""
                  if [ -n "${{ inputs.eslint-config }}" ]; then
                    ESLINT_CONFIG="--config ${{ inputs.eslint-config }}"
                  fi

                  case "${{ needs.setup-validation.outputs.package-manager }}" in
                    npm)
                      npm run lint -- $ESLINT_CONFIG --format json --output-file eslint-report.json || \
                      npm run lint -- $ESLINT_CONFIG
                      ;;
                    yarn)
                      yarn lint $ESLINT_CONFIG --format json --output-file eslint-report.json || \
                      yarn lint $ESLINT_CONFIG
                      ;;
                    pnpm)
                      pnpm lint $ESLINT_CONFIG --format json --output-file eslint-report.json || \
                      pnpm lint $ESLINT_CONFIG
                      ;;
                  esac
              env:
                  LINT_SEVERITY: ${{ inputs.lint-severity }}

            - name: Upload ESLint report
              if: always()
              uses: actions/upload-artifact@v4
              with:
                  name: eslint-report-${{ github.run_id }}
                  path: ${{ inputs.working-directory }}/eslint-report.json
                  retention-days: 30
                  if-no-files-found: warn

            - name: Comment lint results on PR
              if: github.event_name == 'pull_request' && steps.lint.outcome == 'failure'
              uses: actions/github-script@v7
              with:
                  github-token: ${{ secrets.ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
                  script: |
                      const fs = require('fs');
                      const reportPath = '${{ inputs.working-directory }}/eslint-report.json';

                      try {
                        if (fs.existsSync(reportPath)) {
                          const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
                          const errorCount = report.reduce((sum, file) => sum + file.errorCount, 0);
                          const warningCount = report.reduce((sum, file) => sum + file.warningCount, 0);
                          
                          await github.rest.issues.createComment({
                            owner: context.repo.owner,
                            repo: context.repo.repo,
                            issue_number: context.issue.number,
                            body: `## 🔍 ESLint Results\n\n❌ **Errors:** ${errorCount}\n⚠️ **Warnings:** ${warningCount}\n\nPlease fix the linting issues before merging.`
                          });
                        }
                      } catch (error) {
                        console.log('Could not post comment:', error.message);
                      }

    security-scan:
        name: Security Audit
        runs-on: ubuntu-latest
        needs: setup-validation
        if: needs.setup-validation.outputs.should-proceed == 'true' && inputs.run-security-audit
        outputs:
            status: ${{ steps.audit.outcome }}

        steps:
            - name: Checkout calling repository
              uses: actions/checkout@v4
              with:
                  token: ${{ secrets.ACCESS_TOKEN || secrets.GITHUB_TOKEN }}

            - name: Setup Node.js
              uses: actions/setup-node@v4
              with:
                  node-version: ${{ inputs.node-version }}

            - name: Run security audit
              id: audit
              working-directory: ${{ inputs.working-directory }}
              continue-on-error: true
              run: |
                  echo "🔒 Running security audit..."

                  case "${{ needs.setup-validation.outputs.package-manager }}" in
                    npm)
                      npm audit --audit-level=moderate --json > security-audit.json || true
                      npm audit --audit-level=moderate
                      ;;
                    yarn)
                      yarn audit --level moderate --json > security-audit.json || true
                      yarn audit --level moderate
                      ;;
                    pnpm)
                      pnpm audit --audit-level moderate --json > security-audit.json || true
                      pnpm audit --audit-level moderate
                      ;;
                  esac

            - name: Upload security audit report
              if: always()
              uses: actions/upload-artifact@v4
              with:
                  name: security-audit-${{ github.run_id }}
                  path: ${{ inputs.working-directory }}/security-audit.json
                  retention-days: 30
                  if-no-files-found: warn

    summary:
        name: Generate Workflow Summary
        runs-on: ubuntu-latest
        needs: [setup-validation, code-linting, security-scan]
        if: always()

        steps:
            - name: Create workflow summary
              run: |
                  echo "## 📊 Reusable Workflow Summary" >> $GITHUB_STEP_SUMMARY
                  echo "" >> $GITHUB_STEP_SUMMARY
                  echo "### Configuration" >> $GITHUB_STEP_SUMMARY
                  echo "| Parameter | Value |" >> $GITHUB_STEP_SUMMARY
                  echo "|-----------|-------|" >> $GITHUB_STEP_SUMMARY
                  echo "| Node Version | ${{ inputs.node-version }} |" >> $GITHUB_STEP_SUMMARY
                  echo "| Environment | ${{ inputs.environment }} |" >> $GITHUB_STEP_SUMMARY
                  echo "| Package Manager | ${{ needs.setup-validation.outputs.package-manager }} |" >> $GITHUB_STEP_SUMMARY
                  echo "| Working Directory | ${{ inputs.working-directory }} |" >> $GITHUB_STEP_SUMMARY
                  echo "| Lint Severity | ${{ inputs.lint-severity }} |" >> $GITHUB_STEP_SUMMARY
                  echo "| Security Audit | ${{ inputs.run-security-audit }} |" >> $GITHUB_STEP_SUMMARY
                  echo "" >> $GITHUB_STEP_SUMMARY
                  echo "### Job Results" >> $GITHUB_STEP_SUMMARY
                  echo "| Job | Status |" >> $GITHUB_STEP_SUMMARY
                  echo "|-----|--------|" >> $GITHUB_STEP_SUMMARY
                  echo "| Validation | ${{ needs.setup-validation.result }} |" >> $GITHUB_STEP_SUMMARY
                  echo "| Code Linting | ${{ needs.code-linting.result }} |" >> $GITHUB_STEP_SUMMARY
                  echo "| Security Scan | ${{ needs.security-scan.result }} |" >> $GITHUB_STEP_SUMMARY
                  echo "" >> $GITHUB_STEP_SUMMARY

                  # Overall status
                  if [[ "${{ needs.code-linting.result }}" == "success" && "${{ needs.security-scan.result }}" == "success" ]]; then
                    echo "### ✅ All checks passed!" >> $GITHUB_STEP_SUMMARY
                  elif [[ "${{ needs.code-linting.result }}" == "failure" || "${{ needs.security-scan.result }}" == "failure" ]]; then
                    echo "### ❌ Some checks failed" >> $GITHUB_STEP_SUMMARY
                  else
                    echo "### ⚠️ Some checks were skipped or cancelled" >> $GITHUB_STEP_SUMMARY
                  fi

                  echo "" >> $GITHUB_STEP_SUMMARY
                  echo "---" >> $GITHUB_STEP_SUMMARY
                  echo "**Triggered by:** ${{ github.actor }}" >> $GITHUB_STEP_SUMMARY
                  echo "**Repository:** ${{ github.repository }}" >> $GITHUB_STEP_SUMMARY
                  echo "**Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
                  echo "**Run ID:** ${{ github.run_id }}" >> $GITHUB_STEP_SUMMARY