Skip to content

Commit 7ef5901

Browse files
WilliamBerryiiiWilliamBerryiii
committed
ci(.github): add GitHub Actions workflows from hve-core
- add pr-validation.yml orchestrating linting on pull requests - add main.yml for CI on pushes to main branch - add codeql-analysis.yml for Python security scanning - add dependency-review.yml for PR dependency security checks - add individual reusable workflows: spell-check, markdown-lint, table-format, ps-script-analyzer, link-lang-check, markdown-link-check - add Markdown-Link-Check.ps1 script and config 🔧 - Generated by Copilot
1 parent 92da03e commit 7ef5901

12 files changed

+1017
-0
lines changed

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: CodeQL Security Analysis
2+
3+
on:
4+
schedule:
5+
# Weekly scan: Sundays at 4 AM UTC
6+
- cron: '0 4 * * 0'
7+
workflow_call:
8+
9+
permissions:
10+
contents: read
11+
security-events: write
12+
13+
jobs:
14+
analyze:
15+
name: CodeQL Analysis
16+
runs-on: ubuntu-latest
17+
permissions:
18+
contents: read
19+
security-events: write
20+
actions: read
21+
22+
strategy:
23+
fail-fast: false
24+
matrix:
25+
language: ['python']
26+
27+
steps:
28+
- name: Checkout repository
29+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
30+
with:
31+
persist-credentials: false
32+
33+
- name: Initialize CodeQL
34+
uses: github/codeql-action/init@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0
35+
with:
36+
languages: ${{ matrix.language }}
37+
queries: security-extended,security-and-quality
38+
39+
- name: Autobuild
40+
uses: github/codeql-action/autobuild@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0
41+
42+
- name: Perform CodeQL Analysis
43+
uses: github/codeql-action/analyze@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0
44+
with:
45+
category: "/language:${{ matrix.language }}"
46+
47+
- name: Add job summary
48+
if: always()
49+
run: |
50+
echo "## CodeQL Security Analysis Complete" >> $GITHUB_STEP_SUMMARY
51+
echo "**Language:** ${{ matrix.language }}" >> $GITHUB_STEP_SUMMARY
52+
echo "**Queries:** security-extended, security-and-quality" >> $GITHUB_STEP_SUMMARY
53+
echo "" >> $GITHUB_STEP_SUMMARY
54+
echo "📊 View results in the Security tab under Code Scanning" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/dependency-review.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Dependency Review
2+
3+
on:
4+
pull_request:
5+
branches: [main, develop]
6+
workflow_call:
7+
8+
permissions:
9+
contents: read
10+
pull-requests: write
11+
12+
jobs:
13+
dependency-review:
14+
name: Review Dependencies
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
pull-requests: write
19+
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
23+
with:
24+
persist-credentials: false
25+
26+
- name: Dependency Review
27+
uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.3.4
28+
with:
29+
fail-on-severity: moderate
30+
comment-summary-in-pr: always

‎.github/workflows/link-lang-check.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Link Language Check
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
soft-fail:
7+
description: 'Whether to continue on language link violations'
8+
required: false
9+
type: boolean
10+
default: false
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
link-lang-check:
17+
name: Link Language Check
18+
runs-on: ubuntu-latest
19+
permissions:
20+
contents: read
21+
steps:
22+
- name: Harden Runner
23+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.10.2
24+
with:
25+
egress-policy: audit
26+
27+
- name: Checkout code
28+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
29+
with:
30+
persist-credentials: false
31+
32+
- name: Create logs directory
33+
shell: pwsh
34+
run: |
35+
New-Item -ItemType Directory -Force -Path logs | Out-Null
36+
37+
- name: Run Link Language Check
38+
shell: pwsh
39+
run: |
40+
$params = @{}
41+
42+
if ('${{ inputs.soft-fail }}' -eq 'true') {
43+
$params['SoftFail'] = $true
44+
}
45+
46+
& scripts/linting/Invoke-LinkLanguageCheck.ps1 @params
47+
continue-on-error: ${{ inputs.soft-fail }}
48+
49+
- name: Upload link language check results
50+
if: always()
51+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v4.4.3
52+
with:
53+
name: link-lang-check-results
54+
path: logs/link-lang-check-results.json
55+
retention-days: 30
56+
57+
- name: Check results and fail if needed
58+
if: ${{ !inputs.soft-fail }}
59+
shell: pwsh
60+
run: |
61+
if ($env:LINK_LANG_CHECK_FAILED -eq 'true') {
62+
Write-Host "Link language check failed and soft-fail is false. Failing the job."
63+
exit 1
64+
}

‎.github/workflows/main.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
# Spell checking using cspell
13+
spell-check:
14+
name: Spell Check
15+
uses: ./.github/workflows/spell-check.yml
16+
permissions:
17+
contents: read
18+
19+
# Markdown linting using markdownlint-cli2
20+
markdown-lint:
21+
name: Markdown Lint
22+
uses: ./.github/workflows/markdown-lint.yml
23+
permissions:
24+
contents: read
25+
26+
# Markdown table formatting check
27+
table-format:
28+
name: Table Format
29+
uses: ./.github/workflows/table-format.yml
30+
permissions:
31+
contents: read
32+
33+
# PowerShell script analysis
34+
psscriptanalyzer:
35+
name: PSScriptAnalyzer
36+
uses: ./.github/workflows/ps-script-analyzer.yml
37+
with:
38+
changed-files-only: false
39+
permissions:
40+
contents: read
41+
42+
# Link language locale check
43+
link-lang-check:
44+
name: Link Language Check
45+
uses: ./.github/workflows/link-lang-check.yml
46+
permissions:
47+
contents: read
48+
49+
# Markdown link validation
50+
markdown-link-check:
51+
name: Markdown Link Check
52+
uses: ./.github/workflows/markdown-link-check.yml
53+
permissions:
54+
contents: read

‎.github/workflows/markdown-link-check.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: Markdown Link Check
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
soft-fail:
7+
description: 'Whether to continue on broken links'
8+
required: false
9+
type: boolean
10+
default: false
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
markdown-link-check:
17+
name: Check Markdown Links
18+
runs-on: ubuntu-latest
19+
permissions:
20+
contents: read
21+
steps:
22+
- name: Harden Runner
23+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.10.2
24+
with:
25+
egress-policy: audit
26+
27+
- name: Checkout code
28+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
29+
with:
30+
persist-credentials: false
31+
32+
- name: Setup Node.js
33+
uses: actions/setup-node@b9b25d45f70a5d94d88496aa4896bf9ed8f49b67 # v4.1.0
34+
with:
35+
node-version: '20'
36+
cache: 'npm'
37+
38+
- name: Install dependencies
39+
run: npm ci
40+
41+
- name: Create logs directory
42+
shell: pwsh
43+
run: |
44+
New-Item -ItemType Directory -Force -Path logs | Out-Null
45+
46+
- name: Run markdown link check
47+
id: link-check
48+
shell: pwsh
49+
run: |
50+
& scripts/linting/Markdown-Link-Check.ps1
51+
continue-on-error: ${{ inputs.soft-fail }}
52+
53+
- name: Upload markdown link check results
54+
if: always()
55+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v4.4.3
56+
with:
57+
name: markdown-link-check-results
58+
path: logs/markdown-link-check-results.json
59+
retention-days: 30
60+
61+
- name: Check results and fail if needed
62+
if: ${{ !inputs.soft-fail && steps.link-check.outcome == 'failure' }}
63+
shell: pwsh
64+
run: |
65+
Write-Host "Markdown link check failed and soft-fail is false. Failing the job."
66+
exit 1

‎.github/workflows/markdown-lint.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: Markdown Lint
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
soft-fail:
7+
description: 'Whether to continue on markdown lint violations'
8+
required: false
9+
type: boolean
10+
default: false
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
markdown-lint:
17+
name: Markdown Lint
18+
runs-on: ubuntu-latest
19+
permissions:
20+
contents: read
21+
steps:
22+
- name: Harden Runner
23+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.10.2
24+
with:
25+
egress-policy: audit
26+
27+
- name: Checkout code
28+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
29+
with:
30+
persist-credentials: false
31+
32+
- name: Setup Node.js
33+
uses: actions/setup-node@b9b25d45f70a5d94d88496aa4896bf9ed8f49b67 # v4.1.0
34+
with:
35+
node-version: '20'
36+
cache: 'npm'
37+
38+
- name: Install dependencies
39+
run: npm ci
40+
41+
- name: Run markdown lint
42+
id: markdown-lint
43+
run: |
44+
npm run lint:md > markdown-lint-output.txt 2>&1 || echo "MARKDOWN_LINT_FAILED=true" >> $GITHUB_ENV
45+
cat markdown-lint-output.txt
46+
continue-on-error: true
47+
48+
- name: Create annotations
49+
if: env.MARKDOWN_LINT_FAILED == 'true'
50+
run: |
51+
echo "::warning::Markdown lint found violations. Review markdown-lint-output.txt artifact for details."
52+
53+
- name: Upload markdown lint results
54+
if: always()
55+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v4.4.3
56+
with:
57+
name: markdown-lint-results
58+
path: markdown-lint-output.txt
59+
retention-days: 30
60+
61+
- name: Add job summary
62+
if: always()
63+
run: |
64+
echo "## Markdown Lint Results" >> $GITHUB_STEP_SUMMARY
65+
if [ "${{ env.MARKDOWN_LINT_FAILED }}" == "true" ]; then
66+
echo "❌ **Status**: Failed" >> $GITHUB_STEP_SUMMARY
67+
echo "" >> $GITHUB_STEP_SUMMARY
68+
echo "Markdown linting violations detected. Please review the artifact for details." >> $GITHUB_STEP_SUMMARY
69+
else
70+
echo "✅ **Status**: Passed" >> $GITHUB_STEP_SUMMARY
71+
echo "" >> $GITHUB_STEP_SUMMARY
72+
echo "No markdown linting violations detected." >> $GITHUB_STEP_SUMMARY
73+
fi
74+
75+
- name: Fail job if violations found
76+
if: env.MARKDOWN_LINT_FAILED == 'true' && !inputs.soft-fail
77+
run: |
78+
echo "Markdown lint failed"
79+
exit 1

0 commit comments

Comments
 (0)