mirror of
https://github.com/authelia/authelia.git
synced 2026-10-28 09:34:52 +08:00
Amir Zarrinkafsh
3c086c4cf5
Scorecard findings only showed up in the weekly workflow run against `master`, well after the change had merged. The `lint.sh scorecard` subcommand runs the four file based checks up front, so lefthook catches them at commit time and reviewdog annotates them on the pull request. The checks run against a `git checkout-index` export rather than the working tree. Scanning the tree directly walks every `node_modules` and does not finish; the export takes about 15 seconds. Only checks that lost points are reported, as `scorecard` also warns about things it does not penalize, such as the job level `contents` write the contributors workflow needs to push the card. `scorecard` and `jq` are now required tools. CI agents need `scorecard` installed for the reviewdog runner. --------- Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
98 lines
2.8 KiB
YAML
98 lines
2.8 KiB
YAML
# SPDX-FileCopyrightText: 2026 Authelia
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
---
|
|
pre-commit:
|
|
piped: true
|
|
jobs:
|
|
- name: check tools
|
|
# yamllint disable rule:indentation
|
|
run: |
|
|
COUNT=0
|
|
|
|
for TOOL in golangci-lint jq pnpm reuse scorecard shellcheck trufflehog typos yamllint zizmor; do
|
|
if ! command -v ${TOOL} >/dev/null 2>&1; then
|
|
if [ ${COUNT} -eq 0 ]; then
|
|
MISSING=${TOOL}
|
|
elif [ ${COUNT} -eq 1 ]; then
|
|
MISSING=${MISSING}' and '${TOOL}
|
|
else
|
|
MISSING=$(echo ${MISSING} | sed 's/ and /, /')' and '${TOOL}
|
|
fi
|
|
COUNT=$((COUNT + 1))
|
|
fi
|
|
done
|
|
|
|
if [ ${COUNT} -gt 0 ]; then
|
|
echo '❌ You must install '${MISSING}
|
|
exit 1
|
|
fi
|
|
# yamllint enable rule:indentation
|
|
|
|
- name: linters
|
|
group:
|
|
parallel: true
|
|
jobs:
|
|
- name: docs
|
|
run: pnpm --reporter=silent lint {staged_files} && echo "0 issues."
|
|
root: "docs/"
|
|
stage_fixed: true
|
|
|
|
- name: eslint
|
|
run: pnpm --reporter=silent lint {staged_files} && echo "0 issues."
|
|
root: "web/"
|
|
glob: "*.{js,jsx,ts,tsx}"
|
|
stage_fixed: true
|
|
|
|
- name: golangci-lint
|
|
run: golangci-lint run --fix
|
|
glob: "*.go"
|
|
stage_fixed: true
|
|
|
|
- name: reuse
|
|
run: reuse lint-file {staged_files} && echo "0 issues."
|
|
|
|
- name: reuse-project
|
|
# reuse lint-file only sees the staged files, so a REUSE.toml or LICENSES/
|
|
# change that strips coverage from unstaged files needs a full project lint.
|
|
run: reuse lint --lines && echo "0 issues."
|
|
glob: "{REUSE.toml,LICENSES/*}"
|
|
|
|
- name: scorecard
|
|
run: .buildkite/steps/lint.sh scorecard && echo "0 issues."
|
|
glob:
|
|
- "*Dockerfile*"
|
|
- ".github/workflows/*"
|
|
- ".buildkite/hooks/*"
|
|
- ".renovaterc*"
|
|
- "*.sh"
|
|
|
|
- name: shellcheck
|
|
run: shellcheck --format=gcc {staged_files} && echo "0 issues."
|
|
file_types:
|
|
- text/x-shellscript
|
|
- text/x-sh
|
|
|
|
- name: trufflehog
|
|
run: trufflehog --fail --log-level=-1 filesystem -x .trufflehog . && echo "0 issues."
|
|
|
|
- name: typos
|
|
run: typos -w --threads 4 --format brief && echo "0 issues."
|
|
stage_fixed: true
|
|
|
|
- name: yamllint
|
|
run: yamllint -f parsable . && echo "0 issues."
|
|
glob: "*.{yml,yaml}"
|
|
|
|
- name: zizmor
|
|
run: zizmor {staged_files} && echo "0 issues."
|
|
glob: ".github/workflows/*.{yml,yaml}"
|
|
|
|
commit-msg:
|
|
jobs:
|
|
- name: commitlint
|
|
run: pnpm commitlint --edit
|
|
root: "web/"
|
|
...
|