|
| 1 | +name: Check for ephemeral PR images |
| 2 | +on: |
| 3 | + # push: |
| 4 | + pull_request: |
| 5 | + |
| 6 | + |
| 7 | +jobs: |
| 8 | + check-files: |
| 9 | + runs-on: ubuntu-latest |
| 10 | + steps: |
| 11 | + - name: Checkout repository |
| 12 | + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 |
| 13 | + |
| 14 | + - name: Check files matching glob patterns for pr-\d+ pattern |
| 15 | + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7 |
| 16 | + with: |
| 17 | + script: | |
| 18 | + const fs = require('fs'); |
| 19 | + const prPattern = /ghcr\.io\/rackerlabs\/understack.*pr-\d+/ |
| 20 | +
|
| 21 | + // Define glob patterns for files to check for reference to PR images |
| 22 | + const globPatterns = [ |
| 23 | + '**/*.yml', |
| 24 | + '**/*.yaml', |
| 25 | + '**/Dockerfile*', |
| 26 | + '**/.env*', |
| 27 | + ]; |
| 28 | +
|
| 29 | + // Exclude files from checks |
| 30 | + const excludePatterns = [ |
| 31 | + '!**/.git/**', |
| 32 | + '!**/docs/**', |
| 33 | + '!**/ansible/**' |
| 34 | + ]; |
| 35 | +
|
| 36 | + // Combine include and exclude patterns |
| 37 | + const allPatterns = [...globPatterns, ...excludePatterns]; |
| 38 | +
|
| 39 | + core.info('Inspecting files matching following glob patterns:'); |
| 40 | + globPatterns.forEach(pattern => core.info(` Include: ${pattern}`)); |
| 41 | + excludePatterns.forEach(pattern => core.info(` Exclude: ${pattern}`)); |
| 42 | + core.info(''); |
| 43 | +
|
| 44 | + const globber = await glob.create(allPatterns.join('\n')); |
| 45 | + const filesToCheck = await globber.glob(); |
| 46 | +
|
| 47 | + core.info(`Found ${filesToCheck.length} files matching glob patterns:`); |
| 48 | + filesToCheck.forEach(file => core.debug(` - ${file}`)); |
| 49 | + core.debug(''); |
| 50 | +
|
| 51 | + let hasPatternMatch = false; |
| 52 | + const matchedFiles = []; |
| 53 | +
|
| 54 | + for (const filePath of filesToCheck) { |
| 55 | + try { |
| 56 | + const fileContent = fs.readFileSync(filePath, 'utf8'); |
| 57 | +
|
| 58 | + if (prPattern.test(fileContent)) { |
| 59 | + hasPatternMatch = true; |
| 60 | + matchedFiles.push(filePath); |
| 61 | + core.error(`❌ Ephemeral container image reference found in: ${filePath}`); |
| 62 | + } else { |
| 63 | + core.debug(`✅ No pattern found in: ${filePath}`); |
| 64 | + } |
| 65 | + } catch (error) { |
| 66 | + core.info(`Error reading file ${filePath}: ${error.message}`); |
| 67 | + } |
| 68 | + } |
| 69 | +
|
| 70 | + if (hasPatternMatch) { |
| 71 | + core.setFailed(`Pattern 'pr-\\d+' found in ${matchedFiles.length} files: ${matchedFiles.join(', ')}`); |
| 72 | + core.info(`Please switch to a different tag before merging as this container image will not be available after PR is merged`) |
| 73 | + core.info(`Alternatively, if this is intended, edit .github/workflows/no-pr-images.yaml -> excludePatterns.`) |
| 74 | + } else { |
| 75 | + core.info(`✅ All ${filesToCheck.length} files checked - no pr-\\d+ pattern found`); |
| 76 | + } |
0 commit comments