linting.yml

---
name: Linting

on:
  pull_request:

permissions: {}

jobs:
  apply-suggestions-commits:
    name: 'No "Apply suggestions from code review" Commits'
    runs-on: ubuntu-latest
    steps:
      - name: Get PR commits
        id: 'get-pr-commits'
        uses: tim-actions/get-pr-commits@8673d84c368f480628607dbe21c88545811ef23a
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: 'Verify no "Apply suggestions from code review" commits'
        uses: tim-actions/commit-message-checker-with-regex@e16b08b1a7f5cafeb1f8167de05bf1d40239eb5d
        with:
          commits: ${{ steps.get-pr-commits.outputs.commits }}
          pattern: '^(?!.*(apply suggestions from code review))'
          flags: 'i'
          error: 'Commits addressing code review feedback should typically be squashed into the commits under review'

      - name: 'Verify no "fixup!" commits'
        uses: tim-actions/commit-message-checker-with-regex@e16b08b1a7f5cafeb1f8167de05bf1d40239eb5d
        with:
          commits: ${{ steps.get-pr-commits.outputs.commits }}
          pattern: '^(?!fixup!)'
          flags: 'i'
          error: 'Fixup commits should be squashed into the commits under review'

  gitlint:
    name: Commit Message(s)
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
        with:
          fetch-depth: 0
      - name: Run gitlint
        run: make gitlint

  golangci-lint:
    name: Go
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
      - name: Run golangci-lint
        run: make golangci-lint

  licenses:
    name: Dependency Licenses
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c

      - name: Check the licenses
        run: make licensecheck

  markdown-link-check:
    name: Markdown Links (modified files)
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c

      - name: Run markdown-link-check
        uses: gaurav-nelson/github-action-markdown-link-check@4d97ad89bbb0de4be573a9d7a2fc0ce900afc519
        with:
          config-file: ".markdownlinkcheck.json"
          check-modified-files-only: "yes"
          base-branch: ${{ github.base_ref }}

  markdownlint:
    name: Markdown
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
      - name: Run markdownlint
        run: make markdownlint

  packagedoc-lint:
    name: Package Documentation
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
      - name: Run packagedoc-lint
        run: make packagedoc-lint

  vulnerability-scan:
    name: Vulnerability Scanning
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
      - name: Run Anchore vulnerability scanner
        uses: anchore/scan-action@4be3c24559b430723e51858969965e163b196957
        id: scan
        with:
          path: "."
          fail-build: true
          severity-cutoff: negligible
      - name: Show Anchore scan SARIF report
        if: always()
        run: cat ${{ steps.scan.outputs.sarif }}
      - name: Upload Anchore scan SARIF report
        if: always()
        uses: github/codeql-action/upload-sarif@04df1262e6247151b5ac09cd2c303ac36ad3f62b
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}

  yaml-lint:
    name: YAML
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
      - name: Run yamllint
        run: make yamllint