Re-enable checkmake #13526
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| ######################### | |
| ######################### | |
| ## Deploy Docker Image Linters ## | |
| ######################### | |
| ######################### | |
| # Documentation: | |
| # https://help.github.com/en/articles/workflow-syntax-for-github-actions | |
| # | |
| ####################################### | |
| # Start the job on all push to main # | |
| ####################################### | |
| name: "Build & Deploy - DEV linters" | |
| on: | |
| pull_request: | |
| ############### | |
| # Set the Job # | |
| ############### | |
| concurrency: | |
| group: ${{ github.ref_name }}-${{ github.workflow }} | |
| cancel-in-progress: true | |
| jobs: | |
| get-linters-matrix: | |
| name: Get Linters Matrix | |
| runs-on: ubuntu-latest | |
| outputs: | |
| linters: ${{ steps.set-matrix.outputs.linters }} | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v5 | |
| - name: Get PR title or commit message | |
| id: get-title | |
| run: | | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| echo "title=${{ github.event.pull_request.title }}" >> $GITHUB_OUTPUT | |
| else | |
| echo "title=${{ github.event.head_commit.message }}" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Read linters_matrix.json and filter | |
| id: set-matrix | |
| run: | | |
| extract_pkg() { | |
| # Extract after 'upgrade', 'update dependency', 'update docker tag', etc. | |
| pkg=$(echo "$1" | sed -E 's/^chore\(deps\): (upgrade|update dependency|update docker tag|update .* plugin|update .* docker tag) ([^ ]+).*/\2/i') | |
| # If not found, try generic extraction for dependency lines | |
| if [ -z "$pkg" ]; then | |
| pkg=$(echo "$1" | sed -E 's/^chore\(deps\): update dependency ([^ ]+).*/\1/i') | |
| fi | |
| # Extract last segment after / or @ (e.g., friendsofphp/php-cs-fixer -> php-cs-fixer, @salesforce/plugin-packaging -> plugin-packaging) | |
| pkg=$(echo "$pkg" | sed -E 's/^.*[\/@]//') | |
| # Normalize: replace - and / with _, lowercase | |
| pkg=$(echo "$pkg" | sed 's/@//g; s/[-\/]/_/g' | tr '[:upper:]' '[:lower:]') | |
| echo "$pkg" | |
| } | |
| title="${{ steps.get-title.outputs.title }}" | |
| echo "title=$title" | |
| matrix=$(cat .automation/generated/linters_matrix.json | jq -c) | |
| pkg=$(extract_pkg "$title") | |
| echo "Extracted package: $pkg" | |
| if [ -n "$pkg" ] && echo "$title" | grep -iq '^chore(deps)'; then | |
| matches=$(echo "$matrix" | jq -c --arg pkg "$pkg" '[.[] | select(tostring | match($pkg;"i"))]') | |
| if [ "$(echo "$matches" | jq 'length')" -gt 0 ]; then | |
| echo "Filtered linters: $matches" | |
| echo "linters=$matches" >> $GITHUB_OUTPUT | |
| exit 0 | |
| fi | |
| fi | |
| # Default: return all | |
| echo "No specific package found or not a chore(deps) commit, using all linters." | |
| echo "linters=$matrix" >> $GITHUB_OUTPUT | |
| build: | |
| # Name the Job | |
| name: DEV/Linters | |
| # Set the agent to run on | |
| runs-on: ubuntu-latest | |
| needs: get-linters-matrix | |
| permissions: read-all | |
| strategy: | |
| fail-fast: false | |
| max-parallel: 18 | |
| matrix: | |
| linter: ${{ fromJson(needs.get-linters-matrix.outputs.linters) }} | |
| platform: ["linux/amd64"] | |
| # Only run this on the main repo | |
| if: | | |
| ( | |
| (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || | |
| (github.event_name == 'push' && github.repository == 'oxsecurity/megalinter') | |
| ) | |
| && !contains(github.event.head_commit.message, 'skip deploy') | |
| ################## | |
| # Load all steps # | |
| ################## | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v5 | |
| - name: Docker Metadata action | |
| uses: docker/[email protected] | |
| id: meta | |
| with: | |
| images: | | |
| ${{ github.repository }}-only-${{ matrix.linter }} | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| if: ${{ ( ( runner.arch != 'X64' || runner.os != 'Linux' ) && matrix.platform == 'linux/amd64' ) || matrix.platform != 'linux/amd64' }} | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build Image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: linters/${{ matrix.linter }}/Dockerfile | |
| platforms: ${{ matrix.platform }} | |
| build-args: | | |
| BUILD_DATE=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }} | |
| BUILD_VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} | |
| BUILD_REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }} | |
| load: true | |
| push: false | |
| secrets: | | |
| GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| ##################################### | |
| # Run Linter test cases # | |
| ##################################### | |
| - name: Run Test Cases | |
| shell: bash | |
| run: | | |
| GITHUB_REPOSITORY=$([ "${{ github.event_name }}" == "pull_request" ] && echo "${{ github.event.pull_request.head.repo.full_name }}" || echo "${{ github.repository }}") | |
| GITHUB_BRANCH=$([ "${{ github.event_name }}" == "pull_request" ] && echo "${{ github.head_ref }}" || echo "${{ github.ref_name }}") | |
| TEST_KEYWORDS_TO_USE_UPPER="${{ matrix.linter }}" | |
| TEST_KEYWORDS_TO_USE="${TEST_KEYWORDS_TO_USE_UPPER,,}" | |
| docker image ls | |
| docker run -e TEST_CASE_RUN=true -e OUTPUT_FORMAT=text -e OUTPUT_FOLDER=${{ github.sha }} -e OUTPUT_DETAIL=detailed -e GITHUB_SHA=${{ github.sha }} -e GITHUB_REPOSITORY=${GITHUB_REPOSITORY} -e GITHUB_BRANCH=${GITHUB_BRANCH} -e GITHUB_TOKEN="${{ secrets.GITHUB_TOKEN }}" -e TEST_KEYWORDS="${TEST_KEYWORDS_TO_USE}" -e MEGALINTER_VOLUME_ROOT="${GITHUB_WORKSPACE}" -v "/var/run/docker.sock:/var/run/docker.sock:rw" -v ${GITHUB_WORKSPACE}:/tmp/lint ${{ fromJson(steps.meta.outputs.json).tags[0]}} | |
| timeout-minutes: 30 | |
| ############################################## | |
| # Check Docker image security with Trivy # | |
| ############################################## | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: "${{ fromJson(steps.meta.outputs.json).tags[0] }}" | |
| format: "table" | |
| exit-code: "1" | |
| ignore-unfixed: true | |
| scanners: vuln | |
| vuln-type: "os,library" | |
| severity: "CRITICAL,HIGH" | |
| timeout: 10m0s | |
| env: | |
| ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }} |