code-review.yml

name: Code Review

on: [pull_request]

jobs:

  # -- ESLINT -----------------------------------------------------------------
  eslint:
    name: ESLint
    runs-on: ubuntu-latest

    steps:
      - name: Harden the GitHub Actions Runner
        uses: step-security/harden-runner@951b48540b429070694bc8abd82fd6901eb123ca
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
            raw.githubusercontent.com:443
            registry.npmjs.org:443
            snyk.io:443

      - name: Checkout
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - name: Run ESLint
        uses: reviewdog/action-eslint@beb7a743eeb10db90a8529b5bc4031be52e90868 # v1.31.0
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # -- DOCKER -----------------------------------------------------------------
  hadolint:
    name: Hadolint
    runs-on: ubuntu-latest

    steps:
      - name: Harden the GitHub Actions Runner
        uses: step-security/harden-runner@951b48540b429070694bc8abd82fd6901eb123ca
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
            raw.githubusercontent.com:443

      - name: Checkout
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - name: Run hadolint
        uses: reviewdog/action-hadolint@2d90b15b2b969e507fc2a31af6e29ca19a0f9516 # v1.45.0
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}