linter.yml

# Reusable workflow that performs linting on the codebase.
# Executes:
#
# - [Super-Linter](https://github.com/super-linter/super-linter), with some opinionated defaults.
# - [CodeQL](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) to analyze the code.
# - [Ratchet](https://github.com/sethvargo/ratchet) to check that GitHub Action versions are pinned.

name: "Linter"
on:
  workflow_call:
    inputs:
      runs-on:
        description: |
          JSON array of runner(s) to use.
          See https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job.
        type: string
        required: false
        default: '["ubuntu-latest"]'
      linter-env:
        description: |
          Environment variables in multilines format "key=value" to pass to the linter.
          See https://github.com/super-linter/super-linter.
        type: string
        required: false
      codeql-languages:
        description: |
          JSON array of languages to analyze with CodeQL.
          See https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/.
          Leave empty to disable the check.
        type: string
        required: false
        default: '["actions"]'
      action-files:
        description: |
          List of files or directories where GitHub Actions and workflows are located.
          Supports glob patterns.
          Leave empty to disable the check.
        type: string
        required: false
        default: |
          ./action.yml
          ./.github/workflows/**/*.yml
          ./actions/**/*.yml
      lint-all:
        description: "Run checks on all files, not just the changed ones."
        type: boolean
        required: false
        default: ${{ github.event_name != 'pull_request' }}

    secrets:
      github-token:
        description: |
          Token for marking the status of linter run in the Checks section.
          See https://github.com/super-linter/super-linter#how-to-use.
          Default GITHUB_TOKEN.

permissions: {}

jobs:
  lint:
    name: 🧹 Lint Code Base
    runs-on: ${{ fromJson(inputs.runs-on) }}
    permissions:
      contents: read
      statuses: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        if: inputs.lint-all && github.ref_name != github.event.repository.default_branch
        with:
          ref: "${{ github.event.repository.default_branch }}"
          persist-credentials: false

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: "${{ inputs.lint-all && 1 || 0 }}"
          persist-credentials: false

      - if: ${{ inputs.linter-env }}
        env:
          LINTER_ENV: ${{ inputs.linter-env }}
        run: |
          echo "$LINTER_ENV" | while IFS= read -r line; do
            if [ -z "$line" ]; then continue; fi
            echo "$line" >> "$GITHUB_ENV"
          done

      # FIXME: superlinter should auto install required dependencies. See https://github.com/super-linter/super-linter/issues/6089.
      - id: has-prettier-plugins
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const { readFileSync } = require("node:fs");
            const { dirname } = require("node:path");
            const globber = await glob.create('**/package.json');
            for await (const file of globber.globGenerator()) {
              const packageJson = JSON.parse(readFileSync(file, 'utf8'));
              if (packageJson?.prettier?.plugins?.length > 0) {
                core.setOutput("package-json-dir", dirname(file));
                return;
              }
            }
      - uses: hoverkraft-tech/ci-github-nodejs/actions/setup-node@775ce0902c528062cc94141dd7d13261083b752a # 0.22.0
        if: ${{ steps.has-prettier-plugins.outputs.package-json-dir }}
        with:
          working-directory: ${{ steps.has-prettier-plugins.outputs.package-json-dir }}

      - uses: super-linter/super-linter/slim@5119dcd8011e92182ce8219d9e9efc82f16fddb6 # v8.0.0
        env:
          VALIDATE_ALL_CODEBASE: ${{ inputs.lint-all }}
          LOG_LEVEL: WARN
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITHUB_TOKEN: ${{ secrets.github-token || github.token }}
          IGNORE_GITIGNORED_FILES: "true"

  codeql:
    if: ${{ inputs.codeql-languages }}
    name: 🛡️ CodeQL Analysis
    permissions:
      actions: read
      contents: read
      security-events: write
    runs-on: ${{ fromJson(inputs.runs-on) }}
    strategy:
      fail-fast: false
      matrix:
        language: ${{ fromJSON(inputs.codeql-languages) }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
        with:
          languages: ${{ matrix.language }}

      - uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
        with:
          category: "/language:${{matrix.language}}"

  prepare-actions-linting:
    runs-on: ${{ fromJson(inputs.runs-on) }}
    if: ${{ inputs.action-files }}
    permissions:
      contents: read
    outputs:
      action-files: ${{ steps.get-files-to-lint.outputs.action-files }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: "${{ inputs.lint-all && 1 || 0 }}"
          persist-credentials: false

      - id: changed-files
        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
        if: ${{ inputs.lint-all == false }}
        with:
          files: |
            ${{ inputs.action-files }}
          dir_names_exclude_current_dir: true

      - id: get-files-to-lint
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          CHANGED_FILES_OUTPUT: ${{ steps.changed-files.outputs.all_changed_and_modified_files }}
          ACTION_FILES_INPUT: ${{ inputs.action-files }}
        with:
          script: |
            const fs = require("node:fs");
            const path = require("node:path");

            const changedFilesOutput = process.env.CHANGED_FILES_OUTPUT.trim();
            core.debug(`Changed files output: ${changedFilesOutput}`);

            const actionFilesInput = process.env.ACTION_FILES_INPUT.trim();
            core.debug(`Action files input: ${actionFilesInput}`);

            function parseFilePatterns(filePatterns) {
              const patterns = [];
              for (const filePattern of filePatterns.split("\n")) {
                let sanitizedFilePattern = filePattern.trim();
                if (sanitizedFilePattern === "") {
                  continue;
                }

                if (path.isAbsolute(sanitizedFilePattern)) {
                  // Ensure filePattern is within the workspace
                  if (!sanitizedFilePattern.startsWith(process.env.GITHUB_WORKSPACE)) {
                    return core.setFailed(`File / directory is not within the workspace: ${sanitizedFilePattern}`);
                  }
                } else {
                  sanitizedFilePattern = path.join(process.env.GITHUB_WORKSPACE, sanitizedFilePattern);
                }
                patterns.push(sanitizedFilePattern);
              }
              return patterns;
            }

            async function findFilesByPatterns(filePatterns) {
              const foundFiles = (await Promise.all(filePatterns.map(
                async (filePattern) => {
                  const globber = await glob.create(filePattern, { excludeHiddenFiles: false });
                  return await globber.glob();                  
                }
              )))
                .flat()
                .map((file) => path.relative(process.env.GITHUB_WORKSPACE, file));

              return [...new Set(foundFiles)];
            }
                        
            let actionFiles = [];
            if (changedFilesOutput.length > 0) {
              actionFiles = changedFilesOutput.split(" ").filter(file => file && fs.existsSync(file));
              core.debug(`Action files from changed files: ${JSON.stringify(actionFiles)}`);
            } else {
              const parsedActionFiles = parseFilePatterns(actionFilesInput);
              core.debug(`Parsed action files: ${parsedActionFiles}`);

              if (parsedActionFiles.length === 0) {
                return core.setFailed("No action files to lint.");
              }

              actionFiles = await findFilesByPatterns(parsedActionFiles);
              core.debug(`Action files from patterns: ${JSON.stringify(actionFiles)}`);
            }

            if (actionFiles.length > 0) {
              core.setOutput("action-files", [...new Set(actionFiles)].join(" ").trim());
            }

  actions-pinning:
    name: 📌 Check GitHub Actions Pinning
    needs: prepare-actions-linting
    runs-on: ${{ fromJson(inputs.runs-on) }}
    if: ${{ needs.prepare-actions-linting.outputs.action-files }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      # FIXME: should be updated by dependabot. See https://github.com/dependabot/dependabot-core/issues/8362
      - uses: "docker://ghcr.io/sethvargo/ratchet:0.11.4@sha256:242445a1c55430ad7477e6fcf2027c77d03f5760702537bca4cf622e7338fc81" # 0.11.3
        if: ${{ needs.prepare-actions-linting.outputs.action-files }}
        with:
          args: "lint --format human --format actions ${{ needs.prepare-actions-linting.outputs.action-files }}"