Skip to content

Commit 80804c0

Browse files
AlexWaygoodsrittau
AlexWaygood
and
srittau
authored
Add actionlint checks for GitHub Actions (#16316)
* Pin GitHub Actions to full commit hashes * Add zizmor checks for GitHub Actions * Update .pre-commit-config.yaml * Add actionlint checks for GitHub Actions * Run actionlint in GitHub Actions instead of pre-commit.ci * Show actionlint progress in CI * Demonstrate actionlint failure with an unquoted variable * Revert "Demonstrate actionlint failure with an unquoted variable" This reverts commit 0a36c86. * Add actionlint checks for GitHub Actions * Run actionlint in GitHub Actions instead of pre-commit.ci * Show actionlint progress in CI * Demonstrate actionlint failure with an unquoted variable * Revert "Demonstrate actionlint failure with an unquoted variable" This reverts commit 0a36c86. * Update .github/workflows/actionlint.yml * Update .github/workflows/actionlint.yml Co-authored-by: Sebastian Rittau <sebastian.rittau@zfutura.de> * Simplify intentional word splitting in workflows --------- Co-authored-by: Sebastian Rittau <sebastian.rittau@zfutura.de>
1 parent 6b4b7d3 commit 80804c0

5 files changed

Lines changed: 86 additions & 19 deletions

File tree

‎.github/workflows/actionlint.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Lint GitHub Actions workflows
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
paths:
9+
- ".github/workflows/**"
10+
pull_request:
11+
paths:
12+
- ".github/workflows/**"
13+
14+
permissions:
15+
contents: read
16+
17+
concurrency:
18+
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
19+
cancel-in-progress: true
20+
21+
jobs:
22+
actionlint:
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
26+
with:
27+
persist-credentials: false
28+
- name: Run actionlint
29+
# This is the recommended way to run actionlint in CI:
30+
# https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions.
31+
# The actionlint pre-commit hook would be an alternative,
32+
# but it causes our pre-commit CI jobs to time out.
33+
# The Docker image includes ShellCheck and Pyflakes.
34+
uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
35+
with:
36+
args: -color -verbose

‎.github/workflows/daily.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -86,19 +86,24 @@ jobs:
8686
run: |
8787
PACKAGES=$(python tests/get_stubtest_system_requirements.py)
8888
89+
# System package names contain no whitespace or glob characters, so word splitting is intentional.
90+
# shellcheck disable=SC2086
8991
if [ "${{ runner.os }}" = "Linux" ]; then
9092
if [ -n "$PACKAGES" ]; then
91-
printf "Installing APT packages:\n $(echo $PACKAGES | sed 's/ /\n /g')\n"
93+
printf 'Installing APT packages:\n'
94+
printf ' %s\n' $PACKAGES
9295
sudo apt-get update -q && sudo apt-get install -qy $PACKAGES
9396
fi
9497
else
9598
if [ "${{ runner.os }}" = "macOS" ] && [ -n "$PACKAGES" ]; then
96-
printf "Installing Homebrew packages:\n $(echo $PACKAGES | sed 's/ /\n /g')\n"
99+
printf 'Installing Homebrew packages:\n'
100+
printf ' %s\n' $PACKAGES
97101
brew install -q $PACKAGES
98102
fi
99103
100104
if [ "${{ runner.os }}" = "Windows" ] && [ -n "$PACKAGES" ]; then
101-
printf "Installing Chocolatey packages:\n $(echo $PACKAGES | sed 's/ /\n /g')\n"
105+
printf 'Installing Chocolatey packages:\n'
106+
printf ' %s\n' $PACKAGES
102107
choco install -y $PACKAGES
103108
fi
104109
fi

‎.github/workflows/mypy_primer.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141
cd typeshed_to_test
4242
MYPY_VERSION=$(grep mypy== requirements-tests.txt | cut -d = -f 3)
4343
echo "new commit"
44-
git rev-list --format=%s --max-count=1 $GITHUB_SHA
44+
git rev-list --format=%s --max-count=1 "$GITHUB_SHA"
4545
git checkout -b upstream_main origin/main
4646
echo "base commit"
4747
git rev-list --format=%s --max-count=1 upstream_main
@@ -50,9 +50,9 @@ jobs:
5050
# fail action if exit code isn't zero or one
5151
(
5252
mypy_primer \
53-
--new v${MYPY_VERSION} --old v${MYPY_VERSION} \
53+
--new "v${MYPY_VERSION}" --old "v${MYPY_VERSION}" \
5454
--custom-typeshed-repo typeshed_to_test \
55-
--new-typeshed $GITHUB_SHA --old-typeshed upstream_main \
55+
--new-typeshed "$GITHUB_SHA" --old-typeshed upstream_main \
5656
--num-shards 6 --shard-index ${{ matrix.shard-index }} \
5757
--debug \
5858
--output concise \

‎.github/workflows/stubtest_third_party.yml‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -56,30 +56,35 @@ jobs:
5656
# Use the daily.yml workflow to run stubtest on all third party stubs.
5757
function find_stubs {
5858
git diff --name-only "origin/${GITHUB_BASE_REF}" HEAD | \
59-
egrep ^stubs/ | cut -d "/" -f 2 | sort -u | \
60-
(while read stub; do [ -d "stubs/$stub" ] && echo -n "$stub " || true; done)
59+
grep -E ^stubs/ | cut -d "/" -f 2 | sort -u | \
60+
(while IFS= read -r stub; do [ -d "stubs/$stub" ] && echo -n "$stub " || true; done)
6161
}
6262
STUBS=$(find_stubs || echo '')
6363
echo "Changed stubs: $STUBS"
64-
echo "STUBS=$STUBS" >> $GITHUB_ENV
64+
echo "STUBS=$STUBS" >> "$GITHUB_ENV"
6565
- name: Install required system packages
6666
shell: bash
6767
run: |
68+
# System package and stub directory names contain no whitespace or glob characters; split both lists into arguments.
69+
# shellcheck disable=SC2086
6870
if [ -n "$STUBS" ]; then
6971
PACKAGES=$(python tests/get_stubtest_system_requirements.py $STUBS)
7072
if [ "${{ runner.os }}" = "Linux" ]; then
7173
if [ -n "$PACKAGES" ]; then
72-
printf "Installing APT packages:\n $(echo $PACKAGES | sed 's/ /\n /g')\n"
74+
printf 'Installing APT packages:\n'
75+
printf ' %s\n' $PACKAGES
7376
sudo apt-get update -q && sudo apt-get install -qy $PACKAGES
7477
fi
7578
else
7679
if [ "${{ runner.os }}" = "macOS" ] && [ -n "$PACKAGES" ]; then
77-
printf "Installing Homebrew packages:\n $(echo $PACKAGES | sed 's/ /\n /g')\n"
80+
printf 'Installing Homebrew packages:\n'
81+
printf ' %s\n' $PACKAGES
7882
brew install -q $PACKAGES
7983
fi
8084
8185
if [ "${{ runner.os }}" = "Windows" ] && [ -n "$PACKAGES" ]; then
82-
printf "Installing Chocolatey packages:\n $(echo $PACKAGES | sed 's/ /\n /g')\n"
86+
printf 'Installing Chocolatey packages:\n'
87+
printf ' %s\n' $PACKAGES
8388
choco install -y $PACKAGES
8489
fi
8590
fi
@@ -96,6 +101,8 @@ jobs:
96101
PYTHON_EXECUTABLE="python"
97102
fi
98103
104+
# Stub directory names contain no whitespace or glob characters, so word splitting is intentional.
105+
# shellcheck disable=SC2086
99106
$PYTHON_EXECUTABLE tests/stubtest_third_party.py --ci-platforms-only $STUBS
100107
else
101108
echo "Nothing to test"

‎.github/workflows/tests.yml‎

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,11 @@ jobs:
6363
- name: Install required APT packages
6464
run: |
6565
PACKAGES=$(python tests/get_stubtest_system_requirements.py)
66+
# System package names contain no whitespace or glob characters, so word splitting is intentional.
67+
# shellcheck disable=SC2086
6668
if [ -n "$PACKAGES" ]; then
67-
printf "Installing APT packages:\n $(echo $PACKAGES | sed 's/ /\n /g')\n"
69+
printf 'Installing APT packages:\n'
70+
printf ' %s\n' $PACKAGES
6871
sudo apt-get update -q && sudo apt-get install -qy $PACKAGES
6972
fi
7073
- name: Run mypy_test.py
@@ -117,7 +120,11 @@ jobs:
117120
run: |
118121
PACKAGES=$(python tests/get_external_stub_requirements.py)
119122
if [ -n "$PACKAGES" ]; then
120-
uv pip install --python-version ${{ matrix.python-version }} $PACKAGES
123+
PACKAGE_ARGS=()
124+
while IFS= read -r package; do
125+
PACKAGE_ARGS+=("$package")
126+
done <<< "$PACKAGES"
127+
uv pip install --python-version ${{ matrix.python-version }} "${PACKAGE_ARGS[@]}"
121128
fi
122129
# Published stub packages can shadow the checked-in stubs when ty
123130
# resolves their relative imports.
@@ -152,7 +159,11 @@ jobs:
152159
run: |
153160
PACKAGES=$(python tests/get_external_stub_requirements.py)
154161
if [ -n "$PACKAGES" ]; then
155-
uv pip install --python-version ${{ matrix.python-version }} $PACKAGES
162+
PACKAGE_ARGS=()
163+
while IFS= read -r package; do
164+
PACKAGE_ARGS+=("$package")
165+
done <<< "$PACKAGES"
166+
uv pip install --python-version ${{ matrix.python-version }} "${PACKAGE_ARGS[@]}"
156167
fi
157168
# Published stub packages can shadow the checked-in stubs when pyrefly
158169
# resolves their relative imports.
@@ -186,8 +197,11 @@ jobs:
186197
- name: Install required APT packages
187198
run: |
188199
PACKAGES=$(python tests/get_stubtest_system_requirements.py)
200+
# System package names contain no whitespace or glob characters, so word splitting is intentional.
201+
# shellcheck disable=SC2086
189202
if [ -n "$PACKAGES" ]; then
190-
printf "Installing APT packages:\n $(echo $PACKAGES | sed 's/ /\n /g')\n"
203+
printf 'Installing APT packages:\n'
204+
printf ' %s\n' $PACKAGES
191205
sudo apt-get update -q && sudo apt-get install -qy $PACKAGES
192206
fi
193207
- name: Create an isolated venv for testing
@@ -196,11 +210,16 @@ jobs:
196210
run: |
197211
PACKAGES=$(python tests/get_external_stub_requirements.py)
198212
if [ -n "$PACKAGES" ]; then
199-
printf "Installing python packages:\n $(echo $PACKAGES | sed 's/ /\n /g')\n"
200-
uv pip install --python-version ${{ matrix.python-version }} $PACKAGES
213+
PACKAGE_ARGS=()
214+
while IFS= read -r package; do
215+
PACKAGE_ARGS+=("$package")
216+
done <<< "$PACKAGES"
217+
printf 'Installing python packages:\n'
218+
printf ' %s\n' "${PACKAGE_ARGS[@]}"
219+
uv pip install --python-version ${{ matrix.python-version }} "${PACKAGE_ARGS[@]}"
201220
fi
202221
- name: Activate the isolated venv for the rest of the job
203-
run: echo "$PWD/.venv/bin" >> $GITHUB_PATH
222+
run: echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
204223
- name: List 3rd-party stub dependencies installed
205224
run: uv pip freeze
206225
- name: Run pyright with basic settings on all the stubs

0 commit comments

Comments
 (0)