pr-lint.yaml

name: Lint PRs
on:
  pull_request:
    types:
      - opened
      - edited
      - synchronize
      - reopened
  workflow_dispatch:

env:
  # Set once from repo variable or override here for testing
  STEP_SECURITY_EGRESS_POLICY: ${{ vars.STEP_SECURITY_EGRESS_POLICY || 'audit' }}
permissions:
  contents: read

jobs:
  hadolint-pr:
    runs-on: ubuntu-latest
    name: PR - Hadolint
    permissions:
      contents: read
      # For ReviewDog to post comments to the PR
      pull-requests: write
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
        # Ignores do not work: https://github.com/reviewdog/action-hadolint/issues/35 is resolved
      - uses: reviewdog/action-hadolint@2d0eb7c86a0ddd94eb625485f4cc2730e105edd8 # v1.53.0

  shellcheck-pr:
    runs-on: ubuntu-latest
    name: PR - Shellcheck
    permissions:
      contents: read
      # For ReviewDog to post comments to the PR
      pull-requests: write
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1.32.0
        with:
          reporter: github-pr-review
          fail_level: error
          pattern: |
            *.bash
            *.sh
          exclude: |
            */.git/*
            ./source/*
            ./testing/bats/lib/*

  actionlint-pr:
    runs-on: ubuntu-latest
    name: PR - Actionlint
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - run: |
          echo "::add-matcher::.github/actionlint-matcher.json"
          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
          ./actionlint -color -shellcheck=
        shell: bash

  workflow-file-format-pr:
    runs-on: ubuntu-latest
    name: PR - Workflow file format
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - run: ./scripts/format-yaml-files.sh
        shell: bash

  prchecker-lint:
    runs-on: ubuntu-latest
    name: PR - Check title format
    permissions:
      pull-requests: read
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          # Configure which types are allowed (newline-delimited).
          # Default: https://github.com/commitizen/conventional-commit-types
          types: |
            fix
            feat
            build
            ci
            docs
            perf
            refactor
            test
            backport
          # Configure which scopes are allowed (newline-delimited).
          # These are regex patterns auto-wrapped in `^ $`.
          # scopes: |
          #   oss
          #   custom
          #   issue-\d+
          # Configure that a scope doe not have to be provided.
          requireScope: false
          # If the PR contains one of these newline-delimited labels, the
          # validation is skipped. If you want to rerun the validation when
          # labels change, you might want to use the `labeled` and `unlabeled`
          # event triggers in your workflow.
          # In this case we want to skip for Dependabot PRs which always have the
          # `dependencies` label: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#labels
          ignoreLabels: |
            dependencies
            ci
            automerge

  actions-pin-sha:
    runs-on: ubuntu-latest
    name: PR - Actions Pin SHA
    permissions:
      contents: read
      # For ReviewDog to post comments to the PR
      pull-requests: write
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
        with:
          skip_push: "true"
          review: "true"
          config: .pinact.yaml

  zizmor-lint:
    runs-on: ubuntu-latest
    name: PR - Zizmor
    # https://docs.zizmor.sh/
    permissions:
      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
      # contents: read         # Only needed for private repos. Needed to clone the repo.
      # actions: read          # Only needed for private repos. Needed for upload-sarif to read workflow run info.
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
        with:
          # We only want to scan our workflows, no other included source
          inputs: |
            ".github/"
          # Upload to security tab in GitHub, requires permissions: security-events: write
          # Note this does not fail the workflow, just uploads the results to the security tab in GitHub
          advanced-security: true
          min-severity: "medium"