|
1 | 1 | name: Enforce Script Executable Permissions |
2 | 2 |
|
3 | 3 | on: |
4 | | - pull_request_target: |
| 4 | + pull_request: |
5 | 5 | branches: [ "main" ] |
6 | 6 | paths: |
7 | 7 | - '**/run.sh' |
8 | 8 | - '**/*.sh' |
| 9 | + |
9 | 10 | push: |
10 | 11 | branches: [ "main" ] |
| 12 | + paths: |
| 13 | + - '**/run.sh' |
| 14 | + - '**/*.sh' |
| 15 | + |
11 | 16 | workflow_dispatch: |
12 | 17 |
|
13 | 18 | jobs: |
14 | 19 | permissions: |
| 20 | + name: Check script permissions |
15 | 21 | runs-on: ubuntu-latest |
| 22 | + |
16 | 23 | steps: |
17 | 24 | - name: Checkout code |
18 | 25 | uses: actions/checkout@v4 |
19 | 26 |
|
20 | | - - name: Detect missing executable permissions on shell scripts |
| 27 | + - name: Check for missing +x on shell scripts |
21 | 28 | run: | |
22 | | - # Find all .sh and run.sh scripts without +x |
| 29 | + echo "🔍 Checking shell script permissions..." |
23 | 30 | BAD=$(find . -type f \( -name "*.sh" -o -name "run.sh" \) ! -perm -u=x) |
| 31 | +
|
24 | 32 | if [ -n "$BAD" ]; then |
25 | | - echo "::error file=run.sh,line=1::❌ Some shell scripts are missing executable permissions. This can break CI and LAVA. Please fix before merging." |
26 | | - echo "::error file=run.sh,line=2::To fix, run: find . -name '*.sh' -o -name 'run.sh' | xargs chmod +x && git add . && git commit -m 'Fix: restore executable bits on scripts' && git push" |
| 33 | + echo "::error file=run.sh,line=1::❌ Some shell scripts are missing executable permissions. CI and LAVA may break." |
| 34 | + echo "::error file=run.sh,line=2::To fix: find . -name '*.sh' -o -name 'run.sh' | xargs chmod +x && git add . && git commit -m 'Fix: restore executable bits' && git push" |
27 | 35 | echo "" |
28 | | - echo "The following scripts need 'chmod +x':" |
| 36 | + echo "The following files need 'chmod +x':" |
29 | 37 | echo "$BAD" |
30 | | - # Output a PR annotation for each file |
31 | 38 | echo "$BAD" | while read -r file; do |
32 | | - echo "::error file=$file,line=1::$file is not executable. Please run: chmod +x $file && git add $file" |
| 39 | + echo "::error file=$file,line=1::$file is not executable. Run: chmod +x \"$file\" && git add \"$file\"" |
33 | 40 | done |
34 | 41 | exit 1 |
35 | 42 | else |
36 | | - echo "✅ All shell scripts have correct executable permissions." |
| 43 | + echo "✅ All shell scripts have executable permissions." |
37 | 44 | fi |
38 | 45 |
|
39 | | - - name: Detect accidental executables on non-shell files (optional, warning only) |
| 46 | + - name: Warn about non-shell files marked executable (optional) |
40 | 47 | run: | |
41 | | - # (Advanced/optional) Warn if any non-.sh file has +x (customize as needed) |
42 | | - OTHER_EXEC=$(find . -type f ! -name '*.sh' ! -name 'run.sh' -perm -u=x) |
| 48 | + echo "🔍 Checking for accidental executables on non-shell files..." |
| 49 | + OTHER_EXEC=$(find . -type f ! \( -name "*.sh" -o -name "run.sh" \) -perm -u=x) |
| 50 | +
|
43 | 51 | if [ -n "$OTHER_EXEC" ]; then |
44 | | - echo "::warning file=run.sh,line=1::Warning: Non-shell files with executable permissions detected. Review if needed." |
| 52 | + echo "::warning file=run.sh,line=1::⚠️ Some non-shell files have executable bits. Review if appropriate." |
45 | 53 | echo "$OTHER_EXEC" |
| 54 | + else |
| 55 | + echo "✅ No unexpected executables detected." |
46 | 56 | fi |
0 commit comments