|
1 | 1 | # Source repository: https://github.com/actions/dependency-review-action |
2 | 2 |
|
3 | | -name: scan-dependency-review |
| 3 | +name: scan-lint-and-depend-review |
4 | 4 | on: |
5 | 5 | pull_request: |
6 | 6 | workflow_call: |
7 | 7 | workflow_dispatch: |
8 | 8 | inputs: |
9 | 9 | branch: |
10 | | - description: 'Branch to run the scans on' |
11 | | - default: 'main' |
| 10 | + description: "Branch to run the scans on" |
| 11 | + default: "main" |
12 | 12 | type: string |
13 | 13 | all_codebase: |
14 | | - description: 'Validate all codebase or changes/diff only' |
15 | | - default: 'false' |
| 14 | + description: "[true] Validate all codebase. [false] Validate changes/diff only" |
| 15 | + default: "false" |
| 16 | + type: string |
| 17 | + fix_codebase: |
| 18 | + description: "[true] Perform scan and issues fix. [false] Perform scan only." |
| 19 | + default: "false" |
16 | 20 | type: string |
17 | 21 |
|
18 | 22 | permissions: |
19 | 23 | contents: read |
20 | 24 | env: |
21 | | - INPUT_BRANCH: ${{ inputs.branch || github.sha }} |
22 | | - LINTER_RULES_PATH: .github/configs/super-linter |
23 | | - VALIDATE_ALL_CODEBASE: ${{ inputs.all_codebase || 'false' }} |
| 25 | + INPUT_BRANCH: "${{ inputs.branch || github.sha }}" |
| 26 | + LINTER_RULES_PATH: ".github/configs/super-linter" |
| 27 | + SAVE_SUPER_LINTER_SUMMARY: "true" |
| 28 | + ENABLE_GITHUB_ACTIONS_STEP_SUMMARY: "true" |
| 29 | + SUPER_LINTER_OUTPUT_DIRECTORY_NAME: "super-linter-output" |
| 30 | + SUPER_LINTER_SUMMARY_FILE_NAME: "super-linter-summary.md" |
| 31 | + VALIDATE_ALL_CODEBASE: "${{ inputs.all_codebase || 'false' }}" |
| 32 | + PERFORM_CODEBASE_FIX: "${{ inputs.fix_codebase || 'false' }}" |
24 | 33 |
|
25 | 34 | concurrency: |
26 | 35 | group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} |
27 | 36 | cancel-in-progress: true |
28 | 37 |
|
29 | 38 | jobs: |
30 | 39 | dependency-review: |
31 | | - name: 'Super-linter: Workflow initializing' |
32 | | - runs-on: 'ubuntu-22.04' |
| 40 | + name: "dependency-review: Workflow initializing" |
| 41 | + runs-on: "ubuntu-22.04" |
33 | 42 | steps: |
34 | | - - name: 'dependency-review: harden runner' |
| 43 | + - name: "dependency-review: harden runner" |
35 | 44 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 |
36 | 45 | with: |
37 | 46 | egress-policy: audit |
38 | 47 |
|
39 | | - - name: 'dependency-review: checkout repository' |
| 48 | + - name: "dependency-review: checkout repository" |
40 | 49 | uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 |
| 50 | + with: |
| 51 | + ref: "${{ env.INPUT_BRANCH }}" |
41 | 52 |
|
42 | | - - name: 'dependency-review: perform dependency-review action' |
| 53 | + - name: "dependency-review: perform dependency-review action" |
43 | 54 | uses: actions/dependency-review-action@72eb03d02c7872a771aacd928f3123ac62ad6d3a # v4.3.3 |
44 | 55 |
|
45 | 56 | super-linter: |
46 | | - name: 'super-linter: Workflow initializing' |
47 | | - runs-on: 'ubuntu-22.04' |
| 57 | + name: "super-linter: Workflow initializing" |
| 58 | + runs-on: "ubuntu-22.04" |
| 59 | + timeout-minutes: 30 |
48 | 60 | permissions: |
49 | | - contents: read |
| 61 | + contents: write |
50 | 62 | packages: read |
51 | | - timeout-minutes: 90 |
52 | 63 | env: |
53 | | - SUPER_LINTER_OUTPUT_DIRECTORY_NAME: super-linter-output |
54 | | - SUPER_LINTER_SUMMARY_FILE_NAME: super-linter-summary.md |
55 | | - SAVE_SUPER_LINTER_SUMMARY: true |
56 | | - ENABLE_GITHUB_ACTIONS_STEP_SUMMARY : true |
| 64 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 65 | + DISABLE_ERRORS: "false" |
| 66 | + BASH_SEVERITY: "warning" |
57 | 67 | steps: |
58 | | - - name: 'super-linter: Harden Runner' |
59 | | - uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 |
60 | | - with: |
61 | | - egress-policy: audit |
| 68 | + - name: "super-linter: Harden Runner" |
| 69 | + uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 |
| 70 | + with: |
| 71 | + egress-policy: audit |
| 72 | + |
| 73 | + - name: "super-linter: checkout repository [fetch-depth=0]" |
| 74 | + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 |
| 75 | + with: |
| 76 | + fetch-depth: 0 |
| 77 | + ref: "${{ env.INPUT_BRANCH }}" |
| 78 | + |
| 79 | + - name: "super-linter: perform super-linter scan workflow." |
| 80 | + uses: super-linter/super-linter/slim@e1cb86b6e8d119f789513668b4b30bf17fe1efe4 # v7.2.0 x-release-please-version |
| 81 | + env: |
| 82 | + FIX_GO: "${{ env.PERFORM_CODEBASE_FIX }}" |
| 83 | + FIX_GO_MODULES: "${{ env.PERFORM_CODEBASE_FIX }}" |
| 84 | + FIX_GROOVY: "${{ env.PERFORM_CODEBASE_FIX }}" |
| 85 | + FIX_JSON_PRETTIER: "${{ env.PERFORM_CODEBASE_FIX }}" |
| 86 | + FIX_JSONC_PRETTIER: "${{ env.PERFORM_CODEBASE_FIX }}" |
| 87 | + FIX_MARKDOWN_PRETTIER: "${{ env.PERFORM_CODEBASE_FIX }}" |
| 88 | + FIX_PROTOBUF: "${{ env.PERFORM_CODEBASE_FIX }}" |
| 89 | + FIX_PYTHON_BLACK: "${{ env.PERFORM_CODEBASE_FIX }}" |
| 90 | + FIX_YAML_PRETTIER: "${{ env.PERFORM_CODEBASE_FIX }}" |
| 91 | + VALIDATE_BASH_EXEC: true |
| 92 | + VALIDATE_BASH: true |
| 93 | + VALIDATE_GO: true |
| 94 | + VALIDATE_GO_MODULES: true |
| 95 | + VALIDATE_GITHUB_ACTIONS: true |
| 96 | + VALIDATE_GROOVY: true |
| 97 | + VALIDATE_JSON_PRETTIER: true |
| 98 | + VALIDATE_JSONC_PRETTIER: true |
| 99 | + VALIDATE_MARKDOWN_PRETTIER: true |
| 100 | + VALIDATE_PROTOBUF: true |
| 101 | + VALIDATE_PYTHON_BLACK: true |
| 102 | + VALIDATE_YAML_PRETTIER: true |
62 | 103 |
|
63 | | - - name: 'super-linter: checkout repository [fetch-depth=0]' |
64 | | - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 |
65 | | - with: |
66 | | - fetch-depth: 0 |
67 | | - ref: ${{ inputs.branch }} |
| 104 | + - name: "super-linter: clang_format lint/fix. No error approach." |
| 105 | + uses: super-linter/super-linter/slim@e1cb86b6e8d119f789513668b4b30bf17fe1efe4 # v7.2.0 x-release-please-version |
| 106 | + env: |
| 107 | + FIX_CLANG_FORMAT: "${{ env.PERFORM_CODEBASE_FIX }}" |
| 108 | + VALIDATE_CLANG_FORMAT: true |
| 109 | + DISABLE_ERRORS: true |
68 | 110 |
|
69 | | - - name: 'super-linter: perform super-linter scan workflow.' |
70 | | - uses: super-linter/super-linter/slim@e1cb86b6e8d119f789513668b4b30bf17fe1efe4 # v7.2.0 x-release-please-version |
71 | | - env: |
72 | | - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
73 | | - DISABLE_ERRORS: false |
74 | | - BASH_SEVERITY: "warning" |
75 | | - VALIDATE_PROTOBUF: true |
76 | | - VALIDATE_MARKDOWN: true |
77 | | - VALIDATE_JSONC: true |
78 | | - VALIDATE_GO: true |
79 | | - VALIDATE_GITHUB_ACTIONS: true |
80 | | - VALIDATE_CPP: true |
81 | | - VALIDATE_CLANG_FORMAT: true |
82 | | - VALIDATE_BASH: true |
83 | | - VALIDATE_BASH_EXEC: true |
| 111 | + - name: "super-linter: cpp-lint. No error approach." |
| 112 | + uses: super-linter/super-linter/slim@e1cb86b6e8d119f789513668b4b30bf17fe1efe4 # v7.2.0 x-release-please-version |
| 113 | + env: |
| 114 | + VALIDATE_CPP: true |
| 115 | + DISABLE_ERRORS: true |
84 | 116 |
|
85 | | - - name: 'super-linter: upload linter results as an artifact.' |
86 | | - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 |
87 | | - if: env.SAVE_SUPER_LINTER_SUMMARY == 'true' || env.ENABLE_GITHUB_ACTIONS_STEP_SUMMARY == 'true' |
88 | | - with: |
89 | | - name: coverity-reports |
90 | | - path: |
91 | | - '${{ github.workspace }}/${{ env.SUPER_LINTER_OUTPUT_DIRECTORY_NAME }}/${{ env.SUPER_LINTER_SUMMARY_FILE_NAME }}' |
| 117 | + - name: "super-linter: Commit and push linting fixes" |
| 118 | + if: > |
| 119 | + ( github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' ) && |
| 120 | + github.ref_name != github.event.repository.default_branch && |
| 121 | + env.PERFORM_CODEBASE_FIX == 'true' |
| 122 | + uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5.1.0 |
| 123 | + with: |
| 124 | + branch: "${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}" |
| 125 | + commit_message: "super-linter: fix validation stage linting issues" |
| 126 | + commit_user_name: "sys-vsval" |
| 127 | + commit_user_email: "[email protected]" |
| 128 | + |
| 129 | + - name: "super-linter: upload linter results as an artifact." |
| 130 | + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 |
| 131 | + if: env.SAVE_SUPER_LINTER_SUMMARY == 'true' || env.ENABLE_GITHUB_ACTIONS_STEP_SUMMARY == 'true' |
| 132 | + with: |
| 133 | + name: "super-linter-reports" |
| 134 | + path: "${{ github.workspace }}/${{ env.SUPER_LINTER_OUTPUT_DIRECTORY_NAME }}/${{ env.SUPER_LINTER_SUMMARY_FILE_NAME }}" |
0 commit comments