reusable_checks.yml

# Basic checks on the code, incl. coding style, spelling, bandit analysis.
# TODO: add license check
name: Basic checks

on: workflow_call

permissions:
  contents: read

jobs:
  CodeChecks:
    name: Basic code checks
    runs-on: ${{ github.repository_owner == 'oneapi-src' && 'intel-ubuntu-22.04' || 'ubuntu-latest' }}

    steps:
    - name: Checkout repository
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        fetch-depth: 0

    - name: Install dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y cmake libhwloc-dev doxygen

    # Latest distros do not allow global pip installation
    - name: Install Python requirements in venv
      run: |
        python3 -m venv .venv
        . .venv/bin/activate
        echo "$PATH" >> $GITHUB_PATH
        python3 -m pip install -r third_party/requirements.txt

    - name: Configure CMake
      run: >
        cmake
        -B ${{github.workspace}}/build
        -DUMF_FORMAT_CODE_STYLE=ON
        -DUMF_BUILD_TESTS=OFF
        -DUMF_BUILD_LEVEL_ZERO_PROVIDER=OFF
        -DUMF_BUILD_CUDA_PROVIDER=OFF
        -DUMF_BUILD_LIBUMF_POOL_JEMALLOC=OFF

    - name: Check C/C++ formatting
      run: cmake --build build --target clang-format-check

    - name: Check CMake formatting
      run: |
        cmake --build build --target cmake-format-apply
        git diff --exit-code

    - name: Check Python formatting
      run: cmake --build build --target black-format-check

    - name: Run check-license
      run: |
        ./scripts/check_license/check_headers.sh . "Apache-2.0 WITH LLVM-exception" -v

    - name: Run a spell check
      uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
      with:
        config: ./.github/workflows/.spellcheck-conf.toml

    - name: Run codespell
      run: python3 ./.github/scripts/run-codespell.py

    - name: Check spelling in docs
      run: |
        cmake -B build
        cmake --build build --target docs
        sphinx-build -b spelling ./build/docs_build/config ./build/docs_build/spelling_log -W

    # Run Bandit recursively, but omit _deps directory (with 3rd party code) and python's venv
    - name: Run Bandit
      run: python3 -m bandit -r . -x '/_deps/,/.venv/'