container-libs/.github/workflows/validate.yml at main · podman-container-tools/container-libs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
name: validate

on:
  workflow_call:

permissions:
  contents: read

env:
  LINT_VERSION: v2.12.2

jobs:
  basic:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: install deps
      # Version of codespell bundled with Ubuntu is way old, so use pip.
      run: pip install --break-system-packages codespell==v2.4.1
    - name: run codespell
      run: make codespell
    - name: check-ci-yaml
      run: make check-ci-yaml

  lint:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    defaults:
      run:
        working-directory: ./common
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        fetch-depth: 2
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
      with:
        go-version: 1.26.x
        # By default the go cache will only use go.sum in the root which we don't have,
        # make it use for all checksum files.
        # https://github.com/actions/setup-go?tab=readme-ov-file#caching-dependency-files-and-build-outputs
        cache-dependency-path: "**/go.sum"
    - name: install deps
      run: |
        sudo apt-get -qq update
        sudo apt-get -qq install libseccomp-dev libgpgme-dev libbtrfs-dev libsubid-dev
    - name: lint-common
      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
      with:
        version: "${{ env.LINT_VERSION }}"
        args: --verbose
        working-directory: ./common
    - name: lint-image
      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
      with:
        version: "${{ env.LINT_VERSION }}"
        args: --verbose
        working-directory: ./image
    - name: lint-storage
      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
      with:
        version: "${{ env.LINT_VERSION }}"
        args: --verbose
        working-directory: ./storage

    - name: validate seccomp
      run: ./tools/validate_seccomp.sh ./pkg/seccomp

  git-validate:
    # only run this on PRs
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    env:
      # Base commit sha that we use the lint the commit from
      EPOCH_TEST_COMMIT: "${{ github.event.pull_request.base.sha }}"
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        # By default github actions creates a merge commit which fails the validation,
        # we only must validate the actual commits of the author.
        ref: ${{ github.event.pull_request.head.sha }}
        # Fetch all commits, a sparse checkout with only the commits count in the PR will not result in the right range.
        fetch-depth: 0
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
      with:
        go-version: 1.26.x
        # See comment on lint task
        cache-dependency-path: "**/go.sum"
    - name: run git-validation
      run: make .install.gitvalidation && make git-validation

  go-vendor:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
      with:
        go-version: 1.26.x
        # See comment on lint task
        cache-dependency-path: "**/go.sum"
    - name: vendor
      run: make vendor
    - name: check if tree is clean
      run: hack/tree_status.sh