mirror of
https://github.com/hashicorp/vault.git
synced 2026-06-26 17:49:02 -04:00
00281521f0
* actions: pin to latest actions - actions/checkout@9c091bb21b => v7.0.0 Adds a guardrail to prevent accidentally checking out fork pull request code in privileged GitHub Actions contexts (pull_request_target and PR-triggered workflow_run), with an explicit opt-in escape hatch for advanced workflows. - pnpm/action-setup@0ebf47130e => v6.0.9 Update pnpm to v11.7.0 - Add .github/actions/build-ui to ui changed files group - Add .github/actions/build-ui to ui/frontend CODEOWNERS Signed-off-by: Ryan Cragun <me@ryan.ec> Co-authored-by: Ryan Cragun <me@ryan.ec>
110 lines
4.4 KiB
YAML
110 lines
4.4 KiB
YAML
name: Run linters
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, ready_for_review]
|
|
push:
|
|
branches:
|
|
- main
|
|
- release/**
|
|
|
|
concurrency:
|
|
group: ${{ github.head_ref || github.run_id }}-lint
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
setup:
|
|
name: Setup
|
|
runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-22.04-x64"]') }}
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- name: Ensure Go modules are cached
|
|
uses: ./.github/actions/set-up-go
|
|
with:
|
|
github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
|
|
no-restore: true # don't download them on a cache hit
|
|
- uses: ./.github/actions/install-tools
|
|
name: Ensure Vault tools are cached
|
|
with:
|
|
no-restore: true # don't download them on a cache hit
|
|
|
|
deprecations:
|
|
name: Deprecated functions
|
|
runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-22.04-x64"]') }}
|
|
needs: setup
|
|
if: github.base_ref == 'main'
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: ./.github/actions/set-up-go
|
|
with:
|
|
github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
|
|
- uses: ./.github/actions/install-tools # for staticcheck
|
|
- run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com
|
|
- run: make ci-deprecations
|
|
name: Check deprecations
|
|
|
|
codechecker:
|
|
name: Code checks
|
|
runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-22.04-x64"]') }}
|
|
needs: setup
|
|
if: github.base_ref == 'main'
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: ./.github/actions/set-up-go
|
|
with:
|
|
github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
|
|
- uses: ./.github/actions/install-tools # for buf
|
|
- run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com
|
|
# Note: if there is a function we want to ignore the nilnil check for,
|
|
# You can add 'ignore-nil-nil-function-check' somewhere in the
|
|
# godoc for the function.
|
|
- run: make ci-vet-codechecker
|
|
name: Check custom linters
|
|
- run: make protolint
|
|
name: Protobuf lint
|
|
|
|
generate-delta:
|
|
name: Protobuf generate delta
|
|
runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-22.04-x64"]') }}
|
|
needs: setup
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- uses: ./.github/actions/set-up-go
|
|
with:
|
|
github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
|
|
- uses: ./.github/actions/install-tools # for buf and protoc-*
|
|
- run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com
|
|
- name: Check generate delta
|
|
run: make prep check-proto-delta
|
|
|
|
format:
|
|
name: Format
|
|
runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-22.04-x64"]') }}
|
|
needs: setup
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- uses: ./.github/actions/set-up-go
|
|
with:
|
|
github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
|
|
- uses: ./.github/actions/install-tools # for buf and gofumpt
|
|
- run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com
|
|
- name: Go format
|
|
run: make prep check-go-fmt
|
|
- name: Protobuf format
|
|
run: |
|
|
echo "Using buf version $(buf --version)"
|
|
make check-proto-fmt
|
|
|
|
semgrep:
|
|
name: Semgrep
|
|
runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-22.04-x64"]') }}
|
|
container:
|
|
image: returntocorp/semgrep@sha256:cfad18cfb6536aa48ad5a71017207a10320b4e17e3b2bd7b7de27b42dc9651e7 #v1.58
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
- name: Run Semgrep Rules
|
|
run: semgrep ci --include '*.go' --config 'tools/semgrep/ci'
|