pre-submit.lint.yml

# Copyright 2023 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Lint

on:
  push:
    branches: [main, "*"]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [main]
  merge_group:
  workflow_dispatch:

permissions:
  # Needed to check out the repo.
  contents: read

jobs:
  markdownlint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          node-version: 16
      - run: make markdownlint

  markdown-toc:
    name: markdown-toc
    runs-on: ubuntu-latest
    steps:
      - name: Setup Node.js 16
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          node-version: 16
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - run: make markdown-toc
      - name: markdown-toc
        run: ./.github/workflows/scripts/pre-submit.markdown/markdown-toc.sh

  golangci-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
        with:
          go-version-file: "go.mod"
      - env:
          GOLANGCI_LINT_VERSION: "1.53.2"
          GOLANGCI_LINT_CHECKSUM: "2298f73b9bc03b88b91fee06c5d519fc7f9d7f328e2c388615bbd7e85a9d6cae"
        run: |
          set -euo pipefail

          #Install golangci-lint
          curl -sSLo golangci-lint.tar.gz "https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_LINT_VERSION}/golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64.tar.gz"
          echo "golangci-lint checksum is $(sha256sum golangci-lint.tar.gz | awk '{ print $1 }')"
          echo "expected checksum is $GOLANGCI_LINT_CHECKSUM"
          echo "$GOLANGCI_LINT_CHECKSUM  golangci-lint.tar.gz" | sha256sum --strict --check --status || exit 1
          tar xf golangci-lint.tar.gz
          mv "golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64/golangci-lint" /usr/local/bin

          # Run golangci-lint
          make golangci-lint

  shellcheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: shellcheck
        env:
          SHELLCHECK_VERSION: "0.8.0"
          SHELLCHECK_CHECKSUM: "ab6ee1b178f014d1b86d1e24da20d1139656c8b0ed34d2867fbb834dad02bf0a"
        run: |
          set -euo pipefail

          # Install shellcheck
          curl -sSLo shellcheck.tar.gz "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
          echo "shellcheck checksum is $(sha256sum shellcheck.tar.gz | awk '{ print $1 }')"
          echo "expected checksum is $SHELLCHECK_CHECKSUM"
          echo "$SHELLCHECK_CHECKSUM  shellcheck.tar.gz" | sha256sum --strict --check --status || exit 1

          tar xf shellcheck.tar.gz
          mv "shellcheck-v${SHELLCHECK_VERSION}/shellcheck" /usr/local/bin

          make shellcheck

      - name: actionlint
        env:
          ACTIONLINT_VERSION: "1.6.24"
          ACTIONLINT_CHECKSUM: "3c5818744143a5d6754edd3dcc4c2b32c9dfcdd3bb30e0e108fb5e5c505262d4"
        run: |
          set -euo pipefail

          # Install actionlint
          curl -sSLo actionlint.tar.gz "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          echo "actionlint checksum is $(sha256sum actionlint.tar.gz | awk '{ print $1 }')"
          echo "expected checksum is $ACTIONLINT_CHECKSUM"
          echo "$ACTIONLINT_CHECKSUM  actionlint.tar.gz" | sha256sum --strict --check --status || exit 1

          tar xf actionlint.tar.gz
          mv ./actionlint /usr/local/bin

          make actionlint

  yamllint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - env:
          YAMLLINT_VERSION: "1.26.3"
        run: |
          set -euo pipefail

          # Install yamllint
          pip install -r requirements.txt --require-hashes

          # Run yamllint
          make yamllint

  eslint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          node-version: 16
      - run: make eslint

  autogen:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          repository: mbrukman/autogen
          ref: 9026b78e17573b5dda4bff79033c352443551dc5
          path: autogen
      - run: |
          echo "${GITHUB_WORKSPACE}/autogen" >> "${GITHUB_PATH}"
      - run: make autogen
      - name: check diff
        run: |
          set -euo pipefail
          if [ "$(GIT_PAGER="cat" git diff --ignore-space-at-eol | wc -l)" -gt "0" ]; then
              echo "Detected license header changes.  See status below:"
              GIT_PAGER="cat" git diff
              exit 1
          fi