CCM-21858: APIM Auth module

.github/actions/build-docs/action.yml

@@ -11,7 +11,7 @@ inputs:
   pnpm_version:
     description: "pnpm version to install"
     required: false
-    default: "10.33.0"
+    default: "11.15.1"
   pnpm_filters:
     description: "Additional pnpm workspace filters passed to pnpm install"
     required: false

.github/actions/node-install/action.yaml

@@ -0,0 +1,34 @@
+name: 'Node install and setup'
+description: 'Setup node with pnpm and authenticate github package repository'
+
+inputs:
+  node-version:
+    description: 'Node.js version'
+    required: true
+  pnpm-version:
+    description: 'pnpm version'
+    required: true
+  GITHUB_TOKEN:
+    description: "Token for access to github package registry"
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Setup pnpm'
+      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      with:
+        version: '${{ inputs.pnpm-version }}'
+
+    - name: 'Use Node.js'
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+      with:
+        node-version: '${{ inputs.node-version }}'
+        cache: 'pnpm'
+
+    - name: "Configure pnpm for GitHub Packages"
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.GITHUB_TOKEN }}
+      run: |
+        scripts/set-github-token.sh

.github/workflows/release_created.yaml

@@ -1,6 +1,16 @@
 name: Github Release Created
 
 on:
+  workflow_call:
+    inputs:
+      nodejs_version:
+        description: "Node.js version, set by the CI/CD pipeline workflow"
+        required: true
+        type: string
+      pnpm_version:
+        description: "pnpm version, set by the CI/CD pipeline workflow"
+        required: true
+        type: string
   release:
     types: ["published"] # Inherits all input defaults
 
@@ -9,6 +19,23 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  metadata:
+    name: "Set CI/CD metadata"
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    permissions:
+      contents: read
+    outputs:
+      nodejs_version: ${{ steps.variables.outputs.nodejs_version }}
+      pnpm_version: ${{ steps.variables.outputs.pnpm_version }}
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: "Set CI/CD variables"
+        id: variables
+        run: |
+          echo "nodejs_version=$(grep "^nodejs\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
+          echo "pnpm_version=$(grep "^pnpm\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
   deploy-main:
     name: Package and Publish Terraform Modules to GitHub Releases assets
     runs-on: ubuntu-latest
@@ -20,13 +47,25 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Node install and setup
+        uses: ./.github/actions/node-install
+        with:
+          node-version: ${{ inputs.nodejs_version }}
+          pnpm-version: ${{ inputs.pnpm_version }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: "Install dependencies"
+        run: pnpm install --frozen-lockfile
       - name: "Package and Publish Terraform modules"
         run: |
           ARTIFACTS_DIR="$PWD/../../artifacts"
           mkdir -p "$ARTIFACTS_DIR"
           cd infrastructure/terraform/modules
           for module in */; do
             module_name=${module%/}
+            if [ -f "$module_name/pre.sh" ]; then
+              echo "Running pre.sh for $module_name..."
+              (cd "$module_name" && bash pre.sh)
+            fi
             echo "Zipping contents of $module_name..."
             (cd "$module_name" && zip -r "$ARTIFACTS_DIR/terraform-${module_name}.zip" .)
             echo "Publishing $module_name module..."

.github/workflows/stage-2-test.yaml

@@ -41,55 +41,95 @@ jobs:
     name: "Unit tests"
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
+      packages: read
     steps:
       - name: "Checkout code"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Node install and setup
+        uses: ./.github/actions/node-install
+        with:
+          node-version: ${{ inputs.nodejs_version }}
+          pnpm-version: ${{ inputs.pnpm_version }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: "Install dependencies"
+        run: pnpm install --frozen-lockfile
       - name: "Run unit test suite"
         run: |
           make test-unit
       - name: "Save the result of fast test suite"
-        run: |
-          echo "Nothing to save"
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: unit-tests
+          path: |
+            src/**/.reports/unit/test-report.html
+            tools/check-overrides/.reports/unit/test-report.html
+            !**/node_modules/**
+          include-hidden-files: true
+        if: always()
+      - name: "Save the result of code coverage"
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: code-coverage-report
+          path: ".reports/lcov.info"
   test-lint:
     name: "Linting"
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
+      packages: read
     steps:
       - name: "Checkout code"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Node install and setup
+        uses: ./.github/actions/node-install
+        with:
+          pnpm-version: ${{ inputs.pnpm_version }}
+          node-version: ${{ inputs.nodejs_version }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: "Run linting"
         run: |
           make test-lint
-      - name: "Save the linting result"
-        run: |
-          echo "Nothing to save"
-  test-coverage:
-    name: "Test coverage"
-    needs: [test-unit]
+  test-typecheck:
+    name: "Typecheck"
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 6
+    permissions:
+      contents: read
+      packages: read
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: "Checkout code"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: "Run test coverage check"
-        run: |
-          make test-coverage
-      - name: "Save the coverage check result"
+      - name: Node install and setup
+        uses: ./.github/actions/node-install
+        with:
+          pnpm-version: ${{ inputs.pnpm_version }}
+          node-version: ${{ inputs.nodejs_version }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: "Run typecheck"
         run: |
-          echo "Nothing to save"
+          make test-typecheck
   perform-static-analysis:
     name: "Perform static analysis"
     needs: [test-unit]
     runs-on: ubuntu-latest
     permissions:
       id-token: write
       contents: read
-    timeout-minutes: 5
+    timeout-minutes: 4
     steps:
       - name: "Checkout code"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0 # Full history is needed to improving relevancy of reporting
+      - name: "Download coverage report for SONAR"
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        with:
+          name: code-coverage-report
       - name: "Perform static analysis"
         uses: ./.github/actions/perform-static-analysis
         with:

.gitignore

@@ -22,3 +22,4 @@ node_modules
 dist
 .DS_Store
 .reports
+.turbo

.tool-versions

@@ -2,8 +2,8 @@ act 0.2.64
 gitleaks 8.24.0
 jq 1.6
 nodejs 22.15.1
-pnpm 10.33.0
 pre-commit 3.6.0
+pnpm 11.15.1
 terraform 1.10.1
 terraform-docs 0.19.0
 trivy 0.69.2

Makefile

@@ -8,7 +8,7 @@ include scripts/init.mk
 # Example CI/CD targets are: dependencies, build, publish, deploy, clean, etc.
 
 dependencies: # Install dependencies needed to build and test the project @Pipeline
-	# TODO: Implement installation of your project dependencies
+	pnpm install
 
 build: # Build the project artefact @Pipeline
 	(cd docs && make build)
@@ -21,15 +21,17 @@ deploy: # Deploy the project artefact to the target environment @Pipeline
 
 clean:: # Clean-up project resources (main) @Operations
 	rm -f .version
+	pnpm run clean
 	# TODO: Implement project resources clean-up step
 
-config:: _install-dependencies version # Configure development environment (main) @Configuration
+config:: _install-dependencies version dependencies # Configure development environment (main) @Configuration
 	(cd docs && make install)
 
 version:
 	rm -f .version
 	make version-create-effective-file dir=.
 	echo "{ \"schemaVersion\": 1, \"label\": \"version\", \"message\": \"$$(head -n 1 .version 2> /dev/null || echo unknown)\", \"color\": \"orange\" }" > version.json
+
 # ==============================================================================
 
 ${VERBOSE}.SILENT: \