sadpandajoe commented on code in PR #45167:
URL: https://github.com/apache/superset/pull/45167#discussion_r4237364107
##########
.github/workflows/github-action-validator.yml:
##########
@@ -31,22 +31,17 @@ jobs:
with:
persist-credentials: false
- - name: Set up Node.js
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 #
v7.0.0
- with:
- node-version-file: "./superset-frontend/.nvmrc"
+ - name: Test docs-deploy freshness gate
+ run: bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
- - name: Install Dependencies
- # Versions are pinned to avoid ad-hoc, unpinned package installs.
- # Bump deliberately when upgrading.
- # zizmor: ignore[adhoc-packages] - @action-validator is a global CLI
tool installed to validate the repo's workflows; a global CLI install has no
application manifest/lockfile context, and the versions are pinned above
- run: npm install -g @action-validator/[email protected]
@action-validator/[email protected]
+ - name: Setup Go
+ uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e #
v7.0.0
- - name: Run Script
- run: bash .github/workflows/github-action-validator.sh
+ - name: Install kjanat/actionlint
+ run: go install actionlint.kjanat.dev/cmd/[email protected]
- - name: Test docs-deploy freshness gate
- run: bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
+ - name: Static check for GHA workflows
+ run: actionlint
Review Comment:
As written, `actionlint` runs ShellCheck over every `run:` block and this
repo doesn't pass that baseline: the `validate-all-ghas` job on this head exits
1 here with ~49 ShellCheck diagnostics (e.g. SC2086 in
`docker.yml`/`chromatic.yml`, an SC1072 error in `release.yml:42`) plus a real
one at `superset-frontend.yml:113`, where `needs.frontend-build` isn't in
`report-coverage`'s `needs`. Because the zizmor step comes after this one, a
red lint also stops the security audit from running at all. Is the intent to
land the ShellCheck/workflow fixes in this PR, or to start with something like
`actionlint -shellcheck=` (or an `-ignore` list) and tighten later?
##########
.github/workflows/github-action-validator.yml:
##########
@@ -31,22 +31,17 @@ jobs:
with:
persist-credentials: false
- - name: Set up Node.js
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 #
v7.0.0
- with:
- node-version-file: "./superset-frontend/.nvmrc"
+ - name: Test docs-deploy freshness gate
+ run: bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
- - name: Install Dependencies
- # Versions are pinned to avoid ad-hoc, unpinned package installs.
- # Bump deliberately when upgrading.
- # zizmor: ignore[adhoc-packages] - @action-validator is a global CLI
tool installed to validate the repo's workflows; a global CLI install has no
application manifest/lockfile context, and the versions are pinned above
- run: npm install -g @action-validator/[email protected]
@action-validator/[email protected]
+ - name: Setup Go
+ uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e #
v7.0.0
- - name: Run Script
- run: bash .github/workflows/github-action-validator.sh
+ - name: Install kjanat/actionlint
+ run: go install actionlint.kjanat.dev/cmd/[email protected]
- - name: Test docs-deploy freshness gate
- run: bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
+ - name: Static check for GHA workflows
Review Comment:
This narrows what gets validated: the deleted script checked every tracked
`.github/workflows/*` and `.github/actions/*` YAML file, whereas `actionlint`
only follows workflows and the local actions they reference, and doesn't lint a
composite action's own `action.yml`. A broken or unreferenced composite action
could now merge with a green job. Is that coverage loss acceptable, or should
the composite actions get a separate check?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
