linter.yml

# Linter
# ==========================
# Reusable workflow that performs linting on the codebase.
# Executes:
# - [Super-Linter](https://github.com/super-linter/super-linter), with some opinionated defaults.
# - [CodeQL](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) to analyze the code.
# - [Ratchet](https://github.com/sethvargo/ratchet) to check that Github Action versions are pinned.

on:
  workflow_call:
    inputs:
      runs-on:
        description: "JSON array of runner(s) to use. See <https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job>."
        type: string
        required: false
        default: '["ubuntu-latest"]'
      linter-env:
        description: |
          Environment variables in multilines format "key=value" to pass to the linter.
          See <https://github.com/super-linter/super-linter>.
        type: string
        required: false
      codeql-languages:
        description: |
          JSON array of languages to analyze with CodeQL.
          See <https://codeql.github.com/docs/codeql-overview/supported-languages-and-frameworks/>.
          Leave empty to disable the check.
        type: string
        required: false
        default: '["actions"]'
      action-files:
        description: |
          List of files or directories where GitHub Actions and workflows are located.
          Supports glob patterns.
          Leave empty to disable the check.
        type: string
        required: false
        default: |
          ./action.yml
          ./.github/workflows/**/*.yml
          ./actions/**/*.yml
      lint-all:
        description: "Run checks on all files, not just the changed ones."
        type: boolean
        required: false
        default: ${{ github.event_name != 'pull_request' }}

    secrets:
      github-token:
        description: |
          Token for marking the status of linter run in the Checks section.
          See <https://github.com/super-linter/super-linter#how-to-use>.
          Default GITHUB_TOKEN.

permissions:
  contents: read
  statuses: write

jobs:
  lint:
    name: 🧹 Lint Code Base
    runs-on: ${{ fromJson(inputs.runs-on) }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        if: inputs.lint-all && github.ref_name != github.event.repository.default_branch
        with:
          ref: "${{ github.event.repository.default_branch }}"

      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: "${{ inputs.lint-all && 1 || 0 }}"

      - if: ${{ inputs.linter-env }}
        run: |
          LINTER_ENV=$(cat <<EOF
          ${{ inputs.linter-env }}
          EOF
          )

          echo "$LINTER_ENV" | while IFS= read -r line; do
            if [ -z "$line" ]; then continue; fi
            echo "$line" >> "$GITHUB_ENV"
          done

      - uses: super-linter/super-linter/slim@5119dcd8011e92182ce8219d9e9efc82f16fddb6 # v8.0.0
        env:
          VALIDATE_ALL_CODEBASE: ${{ inputs.lint-all }}
          LOG_LEVEL: WARN
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITHUB_TOKEN: ${{ secrets.github-token || github.token }}
          IGNORE_GITIGNORED_FILES: "true"

  codeql:
    if: ${{ inputs.codeql-languages }}
    name: 🛡️ CodeQL Analysis
    permissions:
      contents: read
      actions: read
      security-events: write
    runs-on: ${{ fromJson(inputs.runs-on) }}
    strategy:
      fail-fast: false
      matrix:
        language: ${{ fromJSON(inputs.codeql-languages) }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
        with:
          languages: ${{ matrix.language }}

      - uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
        with:
          category: "/language:${{matrix.language}}"

  actions-pinning:
    name: 📌 Check GitHub Actions Pinning
    runs-on: ${{ fromJson(inputs.runs-on) }}
    if: ${{ inputs.action-files }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: "${{ inputs.lint-all && 1 || 0 }}"

      - id: changed-files
        uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0
        if: ${{ inputs.lint-all == false }}
        with:
          files: ${{ inputs.action-files }}
          dir_names_exclude_current_dir: true

      - id: get-files-to-lint
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const fs = require("node:fs");
            const path = require("node:path");

            const changedFiles = ${{ toJSON(steps.changed-files.outputs.all_changed_and_modified_files) }};

            let actionFiles = [];
            if (changedFiles !== null) {
              actionFiles = changedFiles.split(" ").filter(file => file && fs.existsSync(file));
            } else {
              const actionFilesInput = ${{ toJson(inputs.action-files) }};

              for (const actionFile of actionFilesInput.split("\n")) {
                let sanitizedActionFile = actionFile.trim();
                if (sanitizedActionFile === "") {
                  continue;
                }

                if (path.isAbsolute(sanitizedActionFile)) {
                  // Ensure actionFile is within the workspace
                  if (!sanitizedActionFile.startsWith(process.env.GITHUB_WORKSPACE)) {
                    return core.setFailed(`Action file / directory is not within the workspace: ${sanitizedActionFile}`);
                  }
                } else {
                  sanitizedActionFile = path.join(process.env.GITHUB_WORKSPACE, sanitizedActionFile);
                }
                actionFiles.push(sanitizedActionFile);
              }

              if (actionFiles.length === 0) {
                return core.setFailed("No action files to lint.");
              }

              async function getActionFiles(actionFile) {
                const globber = await glob.create(actionFile,{ matchactionFilesInput: false });
                return await globber.glob();
              }

              actionFiles = (await Promise.all(actionFiles.map(getActionFiles)))
                .flat()
                .map((file) => path.relative(process.env.GITHUB_WORKSPACE, file));

              if (actionFiles.length === 0) {
                return core.setFailed("No action files to lint.");
              }
            }

            const files = actionFiles.map((file) => path.relative(process.env.GITHUB_WORKSPACE, file));
            const filesOutput = [...new Set(files)].join(" ").trim();

            if (filesOutput.length === 0) {
              return;
            }

            core.setOutput("files", filesOutput);

      - id: ratchet
        # FIXME: should be updated by dependabot. See https://github.com/dependabot/dependabot-core/issues/8362
        uses: "docker://ghcr.io/sethvargo/ratchet:0.11.3@sha256:242445a1c55430ad7477e6fcf2027c77d03f5760702537bca4cf622e7338fc81" # 0.11.3
        if: ${{ steps.get-files-to-lint.outputs.files }}
        with:
          args: "lint --format human --format actions ${{ steps.get-files-to-lint.outputs.files }}"