mirror of
https://github.com/Sea-Haven-Industries/.github.git
synced 2026-10-07 16:18:55 +00:00
74 lines
3.2 KiB
YAML
74 lines
3.2 KiB
YAML
name: ci
|
|
|
|
# Self-CI for this org `.github` repo.
|
|
#
|
|
# The org ruleset "main branch protection" requires the `ci / ci` status check on
|
|
# every repo. Consumer repos satisfy it via a short caller workflow that invokes
|
|
# the reusable workflows here. This repo only HOUSES those reusable workflows
|
|
# (all `workflow_call`-only), so nothing emitted `ci / ci` and every PR sat
|
|
# permanently "Expected — Waiting for status to be reported" and could not merge.
|
|
#
|
|
# This workflow produces that check by linting the workflow files with actionlint
|
|
# — genuinely useful CI for a repo whose whole product is GitHub Actions YAML.
|
|
#
|
|
# Naming is load-bearing: the ruleset matches the required status check against
|
|
# the JOB's check-run name, NOT "workflow / job". For a normal (non-reusable) job
|
|
# the check-run name IS the job name, so the job must be named literally "ci / ci"
|
|
# to emit that exact context. (A job named "ci" emits the context "ci" — which the
|
|
# PR UI cosmetically *displays* as "ci / ci" but does NOT satisfy the requirement.)
|
|
# This mirrors the org's aggregator-job convention.
|
|
#
|
|
# actionlint is pinned to a tagged release and installed by downloading the
|
|
# release tarball and verifying its SHA256 — not `curl | bash` — to keep the
|
|
# supply-chain surface auditable. Bump ACTIONLINT_VERSION + ACTIONLINT_SHA256
|
|
# together (checksum from the release's *_checksums.txt).
|
|
#
|
|
# actionlint's shellcheck integration is ON (it defaults to the `shellcheck` on
|
|
# PATH; the ubuntu-latest runner image ships shellcheck 0.9.0, so nothing extra
|
|
# is installed). Do NOT re-add `-shellcheck=` — the empty value silently turns
|
|
# the whole shell-linting half of this gate back off.
|
|
#
|
|
# Two run-steps carry a narrowly-scoped `# shellcheck disable=SC2086` on the
|
|
# single line above the command, because the unquoted expansion there is the
|
|
# point: `sam deploy … $PARAMS` (cd-sam.yaml) and `cdk deploy $STACKS`
|
|
# (cd-cdk.yaml) rely on word-splitting to turn one variable into several argv
|
|
# entries. Quoting them would collapse multiple parameter overrides or stack
|
|
# selectors into one argument and break those deploys. Every other finding was
|
|
# fixed in the shell rather than suppressed. Suppressions stay per-line and
|
|
# commented — never file-wide, and never by weakening this invocation.
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
ci:
|
|
name: ci / ci
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Run policy unit tests
|
|
run: node --test test/pr-policy.test.mjs
|
|
shell: bash
|
|
|
|
- name: Install actionlint
|
|
env:
|
|
ACTIONLINT_VERSION: 1.7.12
|
|
ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
|
|
run: |
|
|
curl -fsSL -o actionlint.tar.gz \
|
|
"https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
|
|
echo "${ACTIONLINT_SHA256} actionlint.tar.gz" | sha256sum -c -
|
|
tar -xzf actionlint.tar.gz actionlint
|
|
shell: bash
|
|
|
|
- name: Lint workflows
|
|
run: |
|
|
shellcheck --version
|
|
./actionlint -color
|
|
shell: bash
|