mirror of
https://github.com/submariner-io/submariner-charts.git
synced 2026-09-20 20:20:35 +00:00
Daniel FarrellandStephen Kitt
e16a2c36df
Set the GitHub Actions token permission to null in most workflows. This results in: GITHUB_TOKEN Permissions Metadata: read The default permissions, used without the null override, are either GITHUB_TOKEN Permissions Actions: write Checks: write Contents: write Deployments: write Discussions: write Issues: write Metadata: read Packages: write Pages: write PullRequests: write RepositoryProjects: write SecurityEvents: write Statuses: write or GITHUB_TOKEN Permissions Actions: read Checks: read Contents: read Deployments: read Discussions: read Issues: read Metadata: read Packages: read Pages: read PullRequests: read RepositoryProjects: read SecurityEvents: read Statuses: read Jobs triggered by PRs get read permissions, other jobs get write. One job requires non-null permissions to function. The dependent issues GHA needs PR/issues write permissions to add/remove `dependent` labels. It needs status write permission to block/unblock PRs when dependencies are missing/met. Fails with HttpError otherwise. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
111 lines
3.4 KiB
YAML
111 lines
3.4 KiB
YAML
---
|
|
name: Linting
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
apply-suggestions-commits:
|
|
name: 'No "Apply suggestions from code review" Commits'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Get PR commits
|
|
id: 'get-pr-commits'
|
|
uses: tim-actions/get-pr-commits@c64db31d359214d244884dd68f971a110b29ab83
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: 'Verify no "Apply suggestions from code review" commits'
|
|
uses: tim-actions/commit-message-checker-with-regex@d6d9770051dd6460679d1cab1dcaa8cffc5c2bbd
|
|
with:
|
|
commits: ${{ steps.get-pr-commits.outputs.commits }}
|
|
pattern: '^(?!.*(apply suggestions from code review))'
|
|
flags: 'i'
|
|
error: 'Commits addressing code review feedback should typically be squashed into the commits under review'
|
|
|
|
- name: 'Verify no "fixup!" commits'
|
|
uses: tim-actions/commit-message-checker-with-regex@d6d9770051dd6460679d1cab1dcaa8cffc5c2bbd
|
|
with:
|
|
commits: ${{ steps.get-pr-commits.outputs.commits }}
|
|
pattern: '^(?!fixup!)'
|
|
flags: 'i'
|
|
error: 'Fixup commits should be squashed into the commits under review'
|
|
|
|
chart-testing:
|
|
name: Helm Chart Linting
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out the repository
|
|
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
|
|
|
|
- name: Set up Helm
|
|
uses: azure/setup-helm@b5b231a831f96336bbfeccc1329990f0005c5bb1
|
|
with:
|
|
version: v3.6.0
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@b55428b1882923874294fa556849718a1d7f2ca5
|
|
with:
|
|
python-version: '3.x'
|
|
|
|
- name: Set up helm/chart-testing
|
|
uses: helm/chart-testing-action@09ed88797198755e5031f25be13da255e7e33aad
|
|
|
|
- name: Run helm/chart-testing (lint)
|
|
run: ct lint --config ct.yaml
|
|
|
|
gitlint:
|
|
name: Commit Message(s)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out the repository
|
|
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Run gitlint
|
|
run: make gitlint
|
|
|
|
helm-docs:
|
|
name: Helm Docs Generation
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out the repository
|
|
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
|
|
|
|
- name: Run helm-docs and verify docs are up-to-date
|
|
run: make helm-docs
|
|
|
|
markdown-link-check:
|
|
name: Markdown Links (modified files)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out the repository
|
|
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
|
|
|
|
- name: Run markdown-link-check
|
|
uses: gaurav-nelson/github-action-markdown-link-check@228fbf4ffb2a86a65314866e9b2322b519fd885f
|
|
with:
|
|
config-file: ".markdownlinkcheck.json"
|
|
check-modified-files-only: "yes"
|
|
base-branch: ${{ github.base_ref }}
|
|
|
|
markdownlint:
|
|
name: Markdown
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out the repository
|
|
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
|
|
- name: Run markdownlint
|
|
run: make markdownlint
|
|
|
|
yaml-lint:
|
|
name: YAML
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out the repository
|
|
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
|
|
- name: Run yamllint
|
|
run: make yamllint
|