lint.yml

name: 'Lint'

# NOTE: This workflow is NOT intended to be a reusable workflow via
# workflow_call. Instead it will be "reused" by configuring via organization
# rulesets as a required workflow.
on:
  # Note that for org required workflows:
  # "Any filters you specify for the supported events are ignored
  # - for example, branches, branches-ignore, paths, types and so on."
  # https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#supported-event-triggers
  pull_request:
  merge_group:

concurrency:
  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
  cancel-in-progress: true

permissions:
  contents: 'read'
  statuses: 'write'

defaults:
  run:
    shell: 'bash'

jobs:
  init:
    name: 'Lint (Initialize)'
    runs-on: 'ubuntu-latest'
    if: |
      ${{ github.repository != 'google-github-actions/.github' }}
    outputs:
      lint-targets: '${{ steps.lint-targets.outputs.lint-targets }}'
      ratchet-files: '${{ steps.lint-targets.outputs.ratchet-files }}'
    steps:
      - name: 'Checkout'
        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
        with:
          fetch-depth: 1
          ref: '${{ github.event.pull_request.head.sha }}'

      - name: 'Identify lint targets'
        id: 'lint-targets'
        env:
          REF: '${{ github.event.pull_request.head.sha }}'
          LC_ALL: 'C'
        run: |-
          set -euo pipefail

          find_files() {
            local filepattern="${1}"
            git ls-tree -r --name-only "${REF}" | grep -E "${filepattern}" | sort || true
          }

          match_files() {
            local filepattern="${1}"
            matches="$(git ls-tree -r --name-only "${REF}" | grep -m 1 -E "${filepattern}")"
            code="${?}"
            if [[ -n "${matches}" ]]; then
              # Ignore exit codes because we found a match.
              # Exit code 141 and higher may occur because we exit early.
              return 0
            fi
            return "${code}"
          }

          declare -a TARGETS=()
          if match_files '.*(\.dockerfile|Dockerfile)$'; then
            TARGETS+=("docker")
          fi
          if match_files '(action\.(yaml|yml))|(\.github/(actions|workflows)/.*\.(yaml|yml))$'; then
            TARGETS+=("github" "ratchet")
            RATCHET_FILES="$(find_files '(action\.(yaml|yml))|(\.github/(actions|workflows)/.*\.(yaml|yml))$' | tr '\n' ' ')"
            echo "::debug::Found ratchetable files: ${RATCHET_FILES}"
            echo "ratchet-files=${RATCHET_FILES}" >> "${GITHUB_OUTPUT}"
          fi
          if match_files 'go.mod$'; then
            TARGETS+=("go")
          fi
          if match_files '.*\.(java)$'; then
            TARGETS+=("java")
          fi
          if match_files 'package.json$'; then
            TARGETS+=("javascript")
          fi
          if match_files '.*\.(sh)$'; then
            TARGETS+=("shell")
          fi
          if match_files '.*\.(tf)$'; then
            TARGETS+=("terraform")
          fi
          if match_files '.*\.(yaml|yml)$'; then
            TARGETS+=("yaml")
          fi

          LINT_TARGETS="$(jq --compact-output --null-input '$ARGS.positional' --args -- "${TARGETS[@]}")"
          echo "::debug::Found lint targets: ${LINT_TARGETS}"
          echo "lint-targets=${LINT_TARGETS}" >> "${GITHUB_OUTPUT}"

  lint:
    runs-on: 'ubuntu-latest'
    name: 'Lint (${{ matrix.lint-target }})'
    needs:
      - 'init'
    if: |-
      ${{ needs.init.outputs.lint-targets != '[]' && github.repository != 'google-github-actions/.github' }}
    strategy:
      fail-fast: false
      max-parallel: 100
      matrix:
        lint-target: '${{ fromJSON(needs.init.outputs.lint-targets) }}'
    steps:
      - name: 'Checkout'
        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
        with:
          fetch-depth: 1

      - name: 'Lint (Docker)'
        if: |-
          ${{ matrix.lint-target == 'docker' }}
        uses: 'abcxyz/actions/.github/actions/lint-docker@main' # ratchet:exclude
        with:
          hadolint_config_url: 'https://raw.githubusercontent.com/abcxyz/actions/main/.hadolint.yml'
          hadolint_version: '2.12.0'

      - name: 'Lint (GitHub Actions)'
        if: |-
          ${{ matrix.lint-target == 'github' }}
        uses: 'abcxyz/actions/.github/actions/lint-github-actions@main' # ratchet:exclude
        with:
          actionlint_version: '1.7.7'

      - name: 'Lint (Go)'
        if: |-
          ${{ matrix.lint-target == 'go' }}
        uses: 'abcxyz/actions/.github/actions/lint-go@main' # ratchet:exclude
        with:
          golangci_url: 'https://raw.githubusercontent.com/abcxyz/actions/main/default.golangci.yml'

      - name: 'Lint (Go modules)'
        if: |-
          ${{ matrix.lint-target == 'go' }}
        uses: 'abcxyz/actions/.github/actions/lint-go-modules@main' # ratchet:exclude

      - name: 'Lint (Java)'
        if: |-
          ${{ matrix.lint-target == 'java' }}
        uses: 'abcxyz/actions/.github/actions/lint-java@main' # ratchet:exclude
        with:
          google_java_format_version: '1.27.0'
          github_token: '${{ secrets.GITHUB_TOKEN }}'

      - name: 'Lint (JavaScript)'
        if: |-
          ${{ matrix.lint-target == 'javascript' }}
        uses: 'abcxyz/actions/.github/actions/lint-javascript@main' # ratchet:exclude

      - name: 'Lint (Ratchet)'
        if: |-
          ${{ matrix.lint-target == 'ratchet' }}
        uses: 'sethvargo/ratchet@main' # ratchet:exclude
        with:
          files: '${{ needs.init.outputs.ratchet-files }}'

      - name: 'Lint (Shell)'
        if: |-
          ${{ matrix.lint-target == 'shell' }}
        uses: 'abcxyz/actions/.github/actions/lint-shell@main' # ratchet:exclude

      - name: 'Lint (YAML)'
        if: |-
          ${{ matrix.lint-target == 'yaml' }}
        uses: 'abcxyz/actions/.github/actions/lint-yaml@main' # ratchet:exclude
        with:
          yamllint_url: 'https://raw.githubusercontent.com/google-github-actions/.github/refs/heads/main/.yamllint.yml'
          yamllint_version: '1.37.1'