Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[DEVOPS-1595] - Add supported workflows to linter workflow #221

Merged
merged 10 commits into from
Dec 20, 2023
Merged

[DEVOPS-1595] - Add supported workflows to linter workflow #221

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
08f4e55
implement warning check for supported actions
Eeebru Dec 15, 2023
7a7d030
Fix: supported actions file name typo
Eeebru Dec 15, 2023
4abb707
UPDATE: test the supported action check
Eeebru Dec 15, 2023
4beca76
UPDATE: Add workflow call to linter
Eeebru Dec 15, 2023
3e9e990
UPDATE: test workflow for supported action check
Eeebru Dec 15, 2023
aa9f7ad
UPDATE: -
Eeebru Dec 15, 2023
d2192ca
UPDATE: change linter ref to master
Eeebru Dec 15, 2023
cc0b05f
UPDATE: change the actions data type to map
Eeebru Dec 18, 2023
3061e7e
UPDATE: use hashset
Eeebru Dec 19, 2023
8831754
rm supported action json file
Eeebru Dec 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/workflow-linter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ on:
pull_request:
paths:
- .github/workflows/**
workflow_call:
workflow_call: {}

jobs:
lint:
Expand Down
14 changes: 13 additions & 1 deletion lint-workflow/lint.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,6 +203,10 @@ def get_action_update(action_id):

def lint(filename):

supported_actions = {"act10ns/slack", "actions/cache", "actions/checkout", "actions/delete-package-versions", "actions/download-artifact", "actions/github-script", "actions/labeler", "actions/setup-dotnet", "actions/setup-java", "actions/setup-node", "actions/setup-python", "actions/stale", "actions/upload-artifact", "android-actions/setup-android", "Asana/create-app-attachment-github-action", "Azure/functions-action", "Azure/get-keyvault-secrets", "Azure/login", "azure/webapps-deploy", "bitwarden/sm-action", "checkmarx/ast-github-action", "chrnorm/deployment-action", "chrnorm/deployment-status", "chromaui/action", "cloudflare/pages-action", "convictional/trigger-workflow-and-wait", "crazy-max/ghaction-import-gpg", "crowdin/github-action", "dawidd6/action-download-artifact", "dawidd6/action-homebrew-bump-formula", "digitalocean/action-doctl", "docker/build-push-action", "docker/setup-buildx-action", "docker/setup-qemu-action", "dorny/test-reporter", "dtolnay/rust-toolchain", "futureware-tech/simulator-action", "hashicorp/setup-packer", "macauley/action-homebrew-bump-cask", "microsoft/setup-msbuild", "ncipollo/release-action", "peter-evans/close-issue", "ruby/setup-ruby", "samuelmeuli/action-snapcraft", "snapcore/action-build", "sonarsource/sonarcloud-github-action", "stackrox/kube-linter-action", "Swatinem/rust-cache", "SwiftDocOrg/github-wiki-publish-action", "SwiftDocOrg/swift-doc", "tj-actions/changed-files", "yogevbd/enforce-label-action"}



findings = []
max_error_level = 0

Expand Down Expand Up @@ -292,9 +296,17 @@ def lint(filename):
logging.info("Skipping local action in workflow.")
break

# If the step has a 'uses' key, check value hash, except bitwarden actions.
# If the step has a 'uses' key, check if actions are in supported actions list and also value hash, except bitwarden actions.
if "bitwarden/gh-actions" not in path:
try:
# Check if actions are in supported actions list.
if path not in supported_actions:
findings.append(
LintFinding(
f"Step {str(i)} of job key '{job_key}' uses an unsupported action: {path}.",
"warning",
)
)
# Check to make sure SHA1 hash is 40 characters.
if len(hash) != 40:
findings.append(
Expand Down