yetus-general-check.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

# yamllint disable rule:line-length
---
name: Yetus General Check

"on":
  pull_request:
    types: [opened, synchronize, reopened]

permissions: {}

jobs:
  general-check:
    runs-on: ubuntu-latest
    timeout-minutes: 600
    permissions:
      contents: read
      statuses: write

    env:
      YETUS_VERSION: '0.15.0'

    steps:
      - name: Checkout HBase
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          path: src
          fetch-depth: 0
          persist-credentials: false

      - name: Set up JDK 17
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Maven cache
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        with:
          path: ~/.m2
          key: hbase-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            hbase-m2-

      - name: Download Yetus
        run: |
          mkdir -p yetus
          cd yetus
          bash "${{ github.workspace }}/src/dev-support/jenkins-scripts/cache-apache-project-artifact.sh" \
            --keys 'https://downloads.apache.org/yetus/KEYS' \
            --verify-tar-gz \
            ./apache-yetus-${{ env.YETUS_VERSION }}-bin.tar.gz \
            yetus/${{ env.YETUS_VERSION }}/apache-yetus-${{ env.YETUS_VERSION }}-bin.tar.gz
          tar --strip-components=1 -xzf apache-yetus-${{ env.YETUS_VERSION }}-bin.tar.gz
          rm apache-yetus-${{ env.YETUS_VERSION }}-bin.tar.gz

      - name: Run Yetus General Check
        env:
          ARCHIVE_PATTERN_LIST: "TEST-*.xml,org.apache.h*.txt,*.dumpstream,*.dump"
          DOCKERFILE: "${{ github.workspace }}/src/dev-support/docker/Dockerfile"
          GITHUB_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_USER: ${{ github.actor }}
          PATCHDIR: "${{ github.workspace }}/yetus-general-check/output"
          PLUGINS: "all,-javadoc,-jira,-shadedjars,-unit"
          SET_JAVA_HOME: "/usr/lib/jvm/java-17"
          SOURCEDIR: "${{ github.workspace }}/src"
          TESTS_FILTER: "checkstyle,javac,pylint,shellcheck,shelldocs,blanks,perlcritic,ruby-lint,rubocop"
          YETUSDIR: "${{ github.workspace }}/yetus"
          AUTHOR_IGNORE_LIST: "hbase-website/app/pages/_docs/docs/_mdx/(multi-page)/building-and-developing/developer-guidelines.mdx,hbase-website/public/book.html"
          BLANKS_EOL_IGNORE_FILE: "dev-support/blanks-eol-ignore.txt"
          BLANKS_TABS_IGNORE_FILE: "dev-support/blanks-tabs-ignore.txt"
          EXCLUDE_TESTS_URL: "https://ci-hbase.apache.org/job/HBase-Find-Flaky-Tests/job/${{ github.base_ref }}/lastSuccessfulBuild/artifact/output/excludes"
          BUILD_THREAD: "4"
          SUREFIRE_FIRST_PART_FORK_COUNT: "1.0C"
          SUREFIRE_SECOND_PART_FORK_COUNT: "0.5C"
          BRANCH_NAME: "${{ github.base_ref }}"
          DEBUG: 'true'
        run: |
          cd "${{ github.workspace }}"
          bash src/dev-support/jenkins_precommit_github_yetus.sh

      - name: Publish Job Summary
        if: always()
        run: |
          cd "${{ github.workspace }}"
          python3 src/dev-support/yetus_console_to_md.py yetus-general-check/output >> $GITHUB_STEP_SUMMARY

      - name: Publish Test Results
        if: always()
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: yetus-general-check-output
          path: ${{ github.workspace }}/yetus-general-check/output
          retention-days: 7

  zizmor:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read

    steps:
      - name: Check for workflow changes
        id: changes
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh pr diff "${{ github.event.pull_request.number }}" --repo "${{ github.repository }}" --name-only | grep -q '^\.github/workflows/'; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "changed=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout HBase
        if: steps.changes.outputs.changed == 'true'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Run zizmor
        if: steps.changes.outputs.changed == 'true'
        run: pipx run zizmor --min-severity=medium .github/workflows/