super-linter.yaml

---
###########################
###########################
## Linter GitHub Actions ##
###########################
###########################
name: Lint Code Base

# Documentation:
# https://help.github.com/en/articles/workflow-syntax-for-github-actions

#############################
# Start the job on all push #
#############################
on:
  push:
    branches-ignore:
      - main
    # Remove the line above to run when pushing to master
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

###############
# Set the Job #
###############
permissions:  # added using https://github.com/step-security/secure-workflows
  contents: read

jobs:
  build:
    # Name the Job
    permissions:
      contents: read  # for actions/checkout to fetch code
      statuses: write  # for github/super-linter to mark status of each linter run
    name: Lint Code Base
    # Set the agent to run on
    runs-on: ubuntu-latest

    ##################
    # Load all steps #
    ##################
    steps:
      ##########################
      # Checkout the code base #
      ##########################
      - name: Harden Runner
        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

      - name: Checkout Code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          # Full git history is needed to get a proper list of changed files within `super-linter`
          fetch-depth: 0

      ################################
      # Run Linter against code base #
      ################################
      - name: Lint Code Base
        uses: github/super-linter@45fc0d88288beee4701c62761281edfee85655d7 # v5.0.0
        env:
          FILTER_REGEX_EXCLUDE: .*(README\.md|Chart\.yaml|NOTES.txt).*
          VALIDATE_ALL_CODEBASE: false
          DEFAULT_BRANCH: main
          VALIDATE_ANSIBLE: false
          ANSIBLE_DIRECTORY: ops/ansible
          VALIDATE_KUBERNETES_KUBEVAL: false
          VALIDATE_JSCPD: false
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}