chore(actions): address zizmor findings #157
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright 2026 Google LLC | |
| # | |
| # Licensed under the Apache License, Version 2.0 (the "License"); | |
| # you may not use this file except in compliance with the License. | |
| # You may obtain a copy of the License at | |
| # | |
| # https://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, software | |
| # distributed under the License is distributed on an "AS IS" BASIS, | |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| # See the License for the specific language governing permissions and | |
| # limitations under the License. | |
| permissions: | |
| contents: read | |
| name: Librarian - Showcase Version Check | |
| on: | |
| schedule: | |
| - cron: '30 3 * * *' # Run daily at 3:30 AM UTC | |
| workflow_dispatch: # Allow manual trigger | |
| pull_request: | |
| paths: | |
| - 'librarian.yaml' | |
| - 'java-showcase/gapic-showcase/pom.xml' | |
| - '.github/workflows/showcase-version-check.yaml' | |
| jobs: | |
| check-version: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| issues: write | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| - name: Extract showcase version from pom.xml | |
| id: extract_version | |
| shell: bash | |
| run: | | |
| version=$(awk -F'[<>]' '/gapic-showcase.version/{print $3; exit}' java-showcase/gapic-showcase/pom.xml) | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| - name: Set up Go | |
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 | |
| with: | |
| go-version: '1.24' | |
| - name: Extract showcase commit from librarian.yaml | |
| id: extract_commit | |
| shell: bash | |
| run: | | |
| version=$(go run github.com/googleapis/librarian/cmd/librarian@latest config get version) | |
| commit=$(go run "github.com/googleapis/librarian/cmd/librarian@${version}" config get sources.showcase.commit) | |
| echo "commit=$commit" >> "$GITHUB_OUTPUT" | |
| - name: Verify showcase version and commit match | |
| shell: bash | |
| run: | | |
| # 1. Query the remote repository for the specific version tag | |
| REMOTE_URL="https://github.com/googleapis/gapic-showcase.git" | |
| TAG_NAME="v${STEPS_EXTRACT_VERSION_OUTPUTS_VERSION}" | |
| OUTPUT=$(git ls-remote "$REMOTE_URL" "refs/tags/$TAG_NAME") | |
| if [ -z "$OUTPUT" ]; then | |
| echo "Error: Tag $TAG_NAME not found on remote $REMOTE_URL" | |
| exit 1 | |
| fi | |
| # 2. Grab the commit hash from the very last line of the output | |
| EXPECTED_COMMIT=$(echo "$OUTPUT" | tail -n 1 | awk '{print $1}') | |
| echo "Expected commit for tag $TAG_NAME: $EXPECTED_COMMIT" | |
| echo "Current librarian commit: ${STEPS_EXTRACT_COMMIT_OUTPUTS_COMMIT}" | |
| # 3. Cross-reference with librarian.yaml | |
| if [ "${STEPS_EXTRACT_COMMIT_OUTPUTS_COMMIT}" != "$EXPECTED_COMMIT" ]; then | |
| echo "Mismatch: librarian.yaml has commit '${STEPS_EXTRACT_COMMIT_OUTPUTS_COMMIT}', but tag '$TAG_NAME' is at commit '$EXPECTED_COMMIT'" | |
| echo "MISMATCH=true" >> "$GITHUB_ENV" | |
| exit 2 | |
| fi | |
| echo "Showcase version and commit are in sync!" | |
| env: | |
| STEPS_EXTRACT_VERSION_OUTPUTS_VERSION: ${{ steps.extract_version.outputs.version }} | |
| STEPS_EXTRACT_COMMIT_OUTPUTS_COMMIT: ${{ steps.extract_commit.outputs.commit }} | |
| - name: Create issue on mismatch | |
| if: failure() && env.MISMATCH == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh issue create \ | |
| -R "${{ github.repository }}" \ | |
| -t "Showcase Version Mismatch: librarian.yaml and pom.xml out of sync" \ | |
| -b "The Showcase version in java-showcase/gapic-showcase/pom.xml and the commit in librarian.yaml do not match. Please update them to match. See logs: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| - name: Create issue on workflow failure | |
| if: failure() && env.MISMATCH != 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh issue create \ | |
| -R "${{ github.repository }}" \ | |
| -t "Showcase Version Check Workflow Failure" \ | |
| -b "The Showcase Version Check workflow has failed due to an unexpected execution error. Please check the logs at ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} for details." |