## Description This PR fixes zizmor --min-severity high findings in our GitHub Actions workflows by: - Pinning all uses: references to immutable commit SHAs (replaces floating tags like @v6 / @main). - Pinning internal Terraform setup action usage (coder/coder/.github/actions/setup-tf@main) to a fixed ref/commit. - Pinning crate-ci/typos to a commit SHA. - Removing GitHub expression template expansion inside a run: block in version-bump.yaml (prevents template injection flagged by zizmor). ## Type of Change - [ ] New module - [ ] New template - [ ] Bug fix - [ ] Feature/enhancement - [ ] Documentation - [x] Other ## Module Information N/A ## Template Information N/A ## Testing & Validation - [ ] Tests pass (`bun test`) - [ ] Code formatted (`bun fmt`) - [x] Changes tested locally - zizmor .github/workflows/* --min-severity high ## Related Issues - coder/registry#642 - https://github.com/coder/registry/pull/662
116 lines
4.5 KiB
YAML
116 lines
4.5 KiB
YAML
name: CI
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
# Cancel in-progress runs for pull requests when developers push new changes
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
|
|
jobs:
|
|
test-terraform:
|
|
name: Validate Terraform output
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
|
|
- name: Detect changed files
|
|
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
|
|
id: filter
|
|
with:
|
|
list-files: shell
|
|
filters: |
|
|
shared:
|
|
- 'test/**'
|
|
- 'package.json'
|
|
- 'bun.lock'
|
|
- 'bunfig.toml'
|
|
- 'tsconfig.json'
|
|
- '.github/workflows/ci.yaml'
|
|
- 'scripts/ts_test_auto.sh'
|
|
- 'scripts/terraform_test_all.sh'
|
|
- 'scripts/terraform_validate.sh'
|
|
- 'scripts/shellcheck_validate.sh'
|
|
modules:
|
|
- 'registry/**/modules/**'
|
|
shell:
|
|
- '**/*.sh'
|
|
all:
|
|
- '**'
|
|
- name: Set up Terraform
|
|
uses: coder/coder/.github/actions/setup-tf@59cdd7e21f4d7da12567c0c29964d298fbf38f27 # v2.29.1
|
|
- name: Set up Bun
|
|
uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2
|
|
with:
|
|
# We're using the latest version of Bun for now, but it might be worth
|
|
# reconsidering. They've pushed breaking changes in patch releases
|
|
# that have broken our CI.
|
|
# Our PR where issues started to pop up: https://github.com/coder/modules/pull/383
|
|
# The Bun PR that broke things: https://github.com/oven-sh/bun/pull/16067
|
|
bun-version: latest
|
|
- name: Install dependencies
|
|
run: bun install
|
|
- name: Run TypeScript tests
|
|
env:
|
|
ALL_CHANGED_FILES: ${{ steps.filter.outputs.all_files }}
|
|
SHARED_CHANGED: ${{ steps.filter.outputs.shared }}
|
|
MODULE_CHANGED_FILES: ${{ steps.filter.outputs.modules_files }}
|
|
run: bun tstest
|
|
- name: Run Terraform tests
|
|
env:
|
|
ALL_CHANGED_FILES: ${{ steps.filter.outputs.all_files }}
|
|
SHARED_CHANGED: ${{ steps.filter.outputs.shared }}
|
|
MODULE_CHANGED_FILES: ${{ steps.filter.outputs.modules_files }}
|
|
run: bun tftest
|
|
- name: Run Terraform Validate
|
|
env:
|
|
ALL_CHANGED_FILES: ${{ steps.filter.outputs.all_files }}
|
|
SHARED_CHANGED: ${{ steps.filter.outputs.shared }}
|
|
MODULE_CHANGED_FILES: ${{ steps.filter.outputs.modules_files }}
|
|
run: bun terraform-validate
|
|
- name: Run ShellCheck
|
|
env:
|
|
ALL_CHANGED_FILES: ${{ steps.filter.outputs.all_files }}
|
|
SHARED_CHANGED: ${{ steps.filter.outputs.shared }}
|
|
SHELL_CHANGED_FILES: ${{ steps.filter.outputs.shell_files }}
|
|
run: bun shellcheck
|
|
- name: Validate set -u ordering
|
|
run: ./scripts/validate_set_u_order.sh
|
|
validate-style:
|
|
name: Check for typos and unformatted code
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
|
|
- name: Install Bun
|
|
uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2
|
|
with:
|
|
bun-version: latest
|
|
# Need Terraform for its formatter
|
|
- name: Install Terraform
|
|
uses: coder/coder/.github/actions/setup-tf@59cdd7e21f4d7da12567c0c29964d298fbf38f27 # v2.29.1
|
|
- name: Install dependencies
|
|
run: bun install
|
|
- name: Validate formatting
|
|
run: bun fmt:ci
|
|
- name: Check for typos
|
|
uses: crate-ci/typos@bb4666ad77b539a6b4ce4eda7ebb6de553704021 # v1.42.0
|
|
with:
|
|
config: .github/typos.toml
|
|
validate-readme-files:
|
|
name: Validate README files
|
|
runs-on: ubuntu-latest
|
|
# We want to do some basic README checks first before we try analyzing the
|
|
# contents
|
|
needs: validate-style
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
|
|
- name: Set up Go
|
|
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
|
|
with:
|
|
go-version: "1.24.0"
|
|
- name: Validate contributors
|
|
run: go build ./cmd/readmevalidation && ./readmevalidation
|
|
- name: Remove build file artifact
|
|
run: rm ./readmevalidation
|