fix: Code analysis rules with the new analyzer package #1272
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- # Linting of pull requests | |
| # Maintain in repo: funfair-server-template | |
| name: "PR: Lint" | |
| on: | |
| pull_request: | |
| types: [opened, edited, synchronize, reopened, ready_for_review, unlocked] | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| concurrency: | |
| group: ${{github.workflow}}-${{github.ref}} | |
| cancel-in-progress: true | |
| env: | |
| HEAD_REF: ${{github.head_ref}} | |
| BASE_REF: ${{github.base_ref}} | |
| jobs: | |
| info: | |
| if: endsWith(github.repository, '-template') | |
| runs-on: [self-hosted, linux, build] | |
| steps: | |
| - name: "Initialise Workspace" | |
| if: runner.environment == 'self-hosted' | |
| shell: bash | |
| run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE" | |
| - name: "Set Active Environment" | |
| shell: bash | |
| run: | | |
| { | |
| echo "ACTIVE_RUNNER_NAME=${{runner.name}}" | |
| echo "ACTIVE_HOSTNAME=$HOSTNAME" | |
| echo "ACTIVE_USER=$USER" | |
| } >> "$GITHUB_ENV" | |
| - name: "Info" | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| core.info(`Branch: ${process.env.HEAD_REF}`); | |
| core.info(`Base Branch: ${process.env.BASE_REF}`); | |
| core.info(`Repo: ${context.repo.owner}/${context.repo.repo}`); | |
| core.info(`Owner: ${context.repo.owner}`); | |
| await core.summary | |
| .addHeading('Info') | |
| .addTable([ | |
| [{data: 'Property', header: true}, {data: 'Value', header: true}], | |
| ['Branch', `${process.env.HEAD_REF}`], | |
| ['Base Branch', `${process.env.BASE_REF}`], | |
| ['Repo', `${context.repo.owner}/${context.repo.repo}`], | |
| ['Owner', `${context.repo.owner}`], | |
| ]) | |
| .write(); | |
| # @@required: merge | |
| include-changelog-entry: | |
| if: |- | |
| github.event.pull_request.draft == false && | |
| !contains(github.event.pull_request.labels.*.name, 'Changelog Not Required') | |
| runs-on: [self-hosted, linux, build] | |
| steps: | |
| - name: "Initialise Workspace" | |
| if: runner.environment == 'self-hosted' | |
| shell: bash | |
| run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE" | |
| - name: "Set Active Environment" | |
| shell: bash | |
| run: | | |
| { | |
| echo "ACTIVE_RUNNER_NAME=${{runner.name}}" | |
| echo "ACTIVE_HOSTNAME=$HOSTNAME" | |
| echo "ACTIVE_USER=$USER" | |
| } >> "$GITHUB_ENV" | |
| - name: "Checkout Source" | |
| if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template')) | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| clean: true | |
| fetch-depth: 2 | |
| - name: "Fetch Base Branch" | |
| if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template')) | |
| shell: bash | |
| run: git fetch origin ${{github.base_ref}} --depth=1 | |
| - name: "Diff Changes" | |
| if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template')) | |
| shell: bash | |
| run: echo "CHANGES=$(git diff --exit-code --no-patch --merge-base origin/main CHANGELOG.md 2> /dev/null && echo 0 || echo $?)" >> "$GITHUB_ENV" | |
| - name: "Report unchanged" | |
| if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template')) && env.CHANGES == '0' | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| core.setFailed('Changelog has not changed') | |
| change-log-entry-is-in-unreleased: | |
| if: github.event.pull_request.draft == false | |
| # As LibGit2Sharp doesn't work on 20.04 | |
| runs-on: [self-hosted, linux, build] | |
| steps: | |
| - name: "Initialise Workspace" | |
| if: runner.environment == 'self-hosted' | |
| shell: bash | |
| run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE" | |
| - name: "Set Active Environment" | |
| shell: bash | |
| run: | | |
| { | |
| echo "ACTIVE_RUNNER_NAME=${{runner.name}}" | |
| echo "ACTIVE_HOSTNAME=$HOSTNAME" | |
| echo "ACTIVE_USER=$USER" | |
| } >> "$GITHUB_ENV" | |
| - name: "Checkout Source" | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| clean: true | |
| fetch-depth: 0 | |
| - name: "Check Required Secrets" | |
| if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template')) | |
| shell: bash | |
| run: | | |
| if [ -z "${{secrets.SOURCE_PUSH_TOKEN}}" ]; then | |
| echo "::error::SOURCE_PUSH_TOKEN is required but not set" | |
| exit 1 | |
| fi | |
| - name: "Install dotnet" | |
| if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template')) | |
| uses: ./.github/actions/dotnet-install | |
| with: | |
| GITHUB_TOKEN: ${{secrets.SOURCE_PUSH_TOKEN}} | |
| NUGET_PUBLIC_RESTORE_FEED_CACHE: ${{vars.NUGET_BAGET_CACHE}} | |
| NUGET_PUBLIC_RESTORE_FEED: ${{vars.NUGET_PUBLIC_RESTORE_FEED || 'https://api.nuget.org/v3/index.json'}} | |
| NUGET_ADDITIONAL_RESTORE_FEED_RELEASE_CACHE: "" | |
| NUGET_ADDITIONAL_RESTORE_FEED_PRERELEASE_CACHE: "" | |
| NUGET_ADDITIONAL_RESTORE_FEED_RELEASE: "" | |
| NUGET_ADDITIONAL_RESTORE_FEED_PRERELEASE: "" | |
| - name: "Install Changelog tool" | |
| if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template')) | |
| uses: ./.github/actions/dotnet-tool | |
| with: | |
| TOOL_NAME: "Credfeto.ChangeLog.Cmd" | |
| TOOL_VERSION: "latest" | |
| - name: "Check Changelog" | |
| if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template')) | |
| uses: ./.github/actions/dotnet-tool-run | |
| with: | |
| WORKING_DIRECTORY: ${{github.workspace}} | |
| TOOL_NAME: "changelog" | |
| TOOL_ARGUMENTS: "--changelog \"${{github.workspace}}/CHANGELOG.md\" --check-insert \"origin/${{github.base_ref}}\"" | |
| # @@required: merge | |
| does-not-contain-secrets: | |
| if: github.event.pull_request.draft == false | |
| runs-on: [self-hosted, linux, build] | |
| steps: | |
| - name: "Initialise Workspace" | |
| if: runner.environment == 'self-hosted' | |
| shell: bash | |
| run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE" | |
| - name: "Set Active Environment" | |
| shell: bash | |
| run: | | |
| { | |
| echo "ACTIVE_RUNNER_NAME=${{runner.name}}" | |
| echo "ACTIVE_HOSTNAME=$HOSTNAME" | |
| echo "ACTIVE_USER=$USER" | |
| } >> "$GITHUB_ENV" | |
| - name: "Checkout Source" | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| clean: true | |
| fetch-depth: 0 | |
| - name: "Check for leaks" | |
| uses: trufflesecurity/trufflehog@6f3c981e7b77f235fd2702dd74af25fc4b72bf11 # v3.96.0 | |
| id: trufflehog | |
| with: | |
| path: "${{ github.workspace }}" | |
| base: "${{ github.event.repository.default_branch }}" | |
| head: HEAD | |
| extra_args: --debug --only-verified | |
| - name: "Scan Results Status" | |
| if: steps.trufflehog.outcome == 'failure' | |
| run: exit 1 | |
| # @@required: merge | |
| has-no-merge-conflicts: | |
| if: github.event.pull_request.draft == false | |
| runs-on: [self-hosted, linux, build] | |
| steps: | |
| - name: "Initialise Workspace" | |
| if: runner.environment == 'self-hosted' | |
| shell: bash | |
| run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE" | |
| - name: "Set Active Environment" | |
| shell: bash | |
| run: | | |
| { | |
| echo "ACTIVE_RUNNER_NAME=${{runner.name}}" | |
| echo "ACTIVE_HOSTNAME=$HOSTNAME" | |
| echo "ACTIVE_USER=$USER" | |
| } >> "$GITHUB_ENV" | |
| - name: "Checkout Source" | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| clean: true | |
| fetch-depth: 1 | |
| - name: "Check for merge conflicts" | |
| uses: ./.github/actions/check-no-merge-conflicts | |
| # @@required: merge | |
| has-no-file-or-folder-case-sensitivity-issues: | |
| if: github.event.pull_request.draft == false | |
| runs-on: [self-hosted, linux, build] | |
| steps: | |
| - name: "Initialise Workspace" | |
| if: runner.environment == 'self-hosted' | |
| shell: bash | |
| run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE" | |
| - name: "Set Active Environment" | |
| shell: bash | |
| run: | | |
| { | |
| echo "ACTIVE_RUNNER_NAME=${{runner.name}}" | |
| echo "ACTIVE_HOSTNAME=$HOSTNAME" | |
| echo "ACTIVE_USER=$USER" | |
| } >> "$GITHUB_ENV" | |
| - name: "Checkout Source" | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| clean: true | |
| fetch-depth: 1 | |
| - name: "Check for case conflicts" | |
| uses: ./.github/actions/check-no-case-sensitivity-conflicts | |
| # @@required: merge | |
| no-ignored-files: | |
| if: github.event.pull_request.draft == false | |
| runs-on: [self-hosted, linux, build] | |
| steps: | |
| - name: "Initialise Workspace" | |
| if: runner.environment == 'self-hosted' | |
| shell: bash | |
| run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE" | |
| - name: "Set Active Environment" | |
| shell: bash | |
| run: | | |
| { | |
| echo "ACTIVE_RUNNER_NAME=${{runner.name}}" | |
| echo "ACTIVE_HOSTNAME=$HOSTNAME" | |
| echo "ACTIVE_USER=$USER" | |
| } >> "$GITHUB_ENV" | |
| - name: "Checkout Source" | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| clean: true | |
| fetch-depth: 1 | |
| - name: "Check for ignored files" | |
| uses: ./.github/actions/check-no-ignored-files | |
| # @@required: merge | |
| dependency-review: | |
| # Check that there are no dependencies with security problems in the PR | |
| if: github.event.pull_request.draft == false | |
| runs-on: [self-hosted, linux, build] | |
| steps: | |
| - name: "Initialise Workspace" | |
| if: runner.environment == 'self-hosted' | |
| shell: bash | |
| run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE" | |
| - name: "Set Active Environment" | |
| shell: bash | |
| run: | | |
| { | |
| echo "ACTIVE_RUNNER_NAME=${{runner.name}}" | |
| echo "ACTIVE_HOSTNAME=$HOSTNAME" | |
| echo "ACTIVE_USER=$USER" | |
| } >> "$GITHUB_ENV" | |
| - name: "Checkout Source" | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| clean: true | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| - name: "Check repo visibility" | |
| uses: ./.github/actions/check-repo-visibility | |
| id: visibility | |
| - name: "Dependency Review" | |
| if: steps.visibility.outputs.is_public == 'true' | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| no-merge-commits: | |
| # Check that there are no merge commits in the PR | |
| if: github.event.pull_request.draft == false | |
| runs-on: [self-hosted, linux, build] | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - name: "Initialise Workspace" | |
| if: runner.environment == 'self-hosted' | |
| shell: bash | |
| run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE" | |
| - name: "Set Active Environment" | |
| shell: bash | |
| run: | | |
| { | |
| echo "ACTIVE_RUNNER_NAME=${{runner.name}}" | |
| echo "ACTIVE_HOSTNAME=$HOSTNAME" | |
| echo "ACTIVE_USER=$USER" | |
| } >> "$GITHUB_ENV" | |
| - name: "Checkout Source" | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| clean: true | |
| fetch-depth: 1 | |
| - name: "Check for merge commits" | |
| uses: ./.github/actions/check-no-merge-commits | |
| valid-changelog: | |
| if: github.event.pull_request.draft == false | |
| runs-on: [self-hosted, linux, build] | |
| steps: | |
| - name: "Initialise Workspace" | |
| if: runner.environment == 'self-hosted' | |
| shell: bash | |
| run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE" | |
| - name: "Set Active Environment" | |
| shell: bash | |
| run: | | |
| { | |
| echo "ACTIVE_RUNNER_NAME=${{runner.name}}" | |
| echo "ACTIVE_HOSTNAME=$HOSTNAME" | |
| echo "ACTIVE_USER=$USER" | |
| } >> "$GITHUB_ENV" | |
| - name: "Checkout Source" | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| clean: true | |
| fetch-depth: 1 | |
| - name: "Install dotnet" | |
| uses: ./.github/actions/dotnet-install | |
| with: | |
| GITHUB_TOKEN: ${{secrets.SOURCE_PUSH_TOKEN}} | |
| NUGET_PUBLIC_RESTORE_FEED_CACHE: ${{vars.NUGET_BAGET_CACHE}} | |
| NUGET_PUBLIC_RESTORE_FEED: ${{vars.NUGET_PUBLIC_RESTORE_FEED || 'https://api.nuget.org/v3/index.json'}} | |
| NUGET_ADDITIONAL_RESTORE_FEED_RELEASE_CACHE: "" | |
| NUGET_ADDITIONAL_RESTORE_FEED_PRERELEASE_CACHE: "" | |
| NUGET_ADDITIONAL_RESTORE_FEED_RELEASE: "" | |
| NUGET_ADDITIONAL_RESTORE_FEED_PRERELEASE: "" | |
| - name: "Install Changelog tool" | |
| uses: ./.github/actions/dotnet-tool | |
| with: | |
| TOOL_NAME: "Credfeto.ChangeLog.Cmd" | |
| TOOL_VERSION: "latest" | |
| - name: "Check Changelog" | |
| uses: ./.github/actions/dotnet-tool-run | |
| with: | |
| WORKING_DIRECTORY: ${{github.workspace}} | |
| TOOL_NAME: "changelog" | |
| TOOL_ARGUMENTS: "--changelog \"${{github.workspace}}/CHANGELOG.md\" --lint" | |
| # @@required: main | |
| lint-code: | |
| if: |- | |
| github.event.pull_request.draft == false && | |
| ( !startsWith(github.head_ref, 'release/') && !startsWith(github.head_ref, 'hotfix/') ) | |
| runs-on: [self-hosted, linux, build] | |
| steps: | |
| - name: "Initialise Workspace" | |
| if: runner.environment == 'self-hosted' | |
| shell: bash | |
| run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE" | |
| - name: "Set Active Environment" | |
| shell: bash | |
| run: | | |
| { | |
| echo "ACTIVE_RUNNER_NAME=${{runner.name}}" | |
| echo "ACTIVE_HOSTNAME=$HOSTNAME" | |
| echo "ACTIVE_USER=$USER" | |
| } >> "$GITHUB_ENV" | |
| - name: "Checkout Source" | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| clean: true | |
| fetch-depth: 0 | |
| - name: "Check Required Secrets" | |
| shell: bash | |
| run: | | |
| if [ -z "${{secrets.SOURCE_PUSH_TOKEN}}" ]; then | |
| echo "::error::SOURCE_PUSH_TOKEN is required but not set" | |
| exit 1 | |
| fi | |
| - name: "Run Linter" | |
| uses: super-linter/super-linter@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0 | |
| env: | |
| CLOUDFORMATION_CONFIG_FILE: .cfnlintrc.yaml | |
| DEFAULT_BRANCH: main | |
| ENABLE_GITHUB_ACTIONS_STEP_SUMMARY: true | |
| GITHUB_ACTIONS_CONFIG_FILE: actionlint.yaml | |
| GITHUB_TOKEN: ${{secrets.SOURCE_PUSH_TOKEN}} | |
| MULTI_STATUS: true | |
| SAVE_SUPER_LINTER_SUMMARY: true | |
| SQLFLUFF_CONFIG_FILE: .sqlfluff | |
| VALIDATE_ALL_CODEBASE: false | |
| VALIDATE_ANSIBLE: true | |
| VALIDATE_BASH: true | |
| VALIDATE_CLOUDFORMATION: true | |
| VALIDATE_CSS: true | |
| VALIDATE_DOCKERFILE: true | |
| VALIDATE_DOCKERFILE_HADOLINT: true | |
| VALIDATE_ENV: true | |
| VALIDATE_GITHUB_ACTIONS: true | |
| VALIDATE_JSON: true | |
| VALIDATE_MD: true | |
| VALIDATE_POWERSHELL: true | |
| VALIDATE_PYTHON: true | |
| VALIDATE_PYTHON_PYLINT: true | |
| VALIDATE_SQLFLUFF: true | |
| VALIDATE_TYPESCRIPT_ES: true | |
| VALIDATE_XML: true | |
| VALIDATE_YAML: true | |
| # @@required: main | |
| poutine: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| steps: | |
| - name: "Initialise Workspace" | |
| if: runner.environment == 'self-hosted' | |
| shell: bash | |
| run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE" | |
| - name: "Checkout Source" | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: "Check repo visibility" | |
| uses: ./.github/actions/check-repo-visibility | |
| id: visibility | |
| - name: "Ensure Results folder exists" | |
| working-directory: ${{github.workspace}} | |
| shell: bash | |
| run: | | |
| [ ! -d "${{github.workspace}}/results" ] && mkdir "${{github.workspace}}/results" || echo "Results created" | |
| - name: "Poutine" | |
| uses: boostsecurityio/poutine-action@e240ebd3eff8b2db5a8e5f6b28f58739d7db2247 # v1.1.4 | |
| with: | |
| format: 'sarif' | |
| output: "${{github.workspace}}/results/poutine.sarif" | |
| - name: "Summarise Poutine findings" | |
| working-directory: ${{github.workspace}}/results | |
| shell: bash | |
| run: | | |
| { | |
| echo "## Poutine findings" | |
| echo | |
| echo "| Rule | Level | File | Line | Message |" | |
| echo "| --- | --- | --- | --- | --- |" | |
| jq -r ' | |
| .runs[].results[] | | |
| [ | |
| (.ruleId // "-"), | |
| (.level // "-"), | |
| (.locations[0].physicalLocation.artifactLocation.uri // "-"), | |
| (.locations[0].physicalLocation.region.startLine // "-" | tostring), | |
| (.message.text // "-" | gsub("\\r?\\n"; " ") | gsub("\\|"; "\\|")) | |
| ] | "| " + join(" | ") + " |" | |
| ' poutine.sarif | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| ERROR_COUNT=$(jq '[.runs[].results[] | select(.level == "error")] | length' poutine.sarif) | |
| if [ "$ERROR_COUNT" -gt 0 ]; then | |
| echo "::error::Poutine found ${ERROR_COUNT} error-level finding(s); see job summary for details." | |
| exit 1 | |
| fi | |
| ############################################################################################################ | |
| # Upload Sarif files to GitHub | |
| ############################################################################################################ | |
| - name: "Upload SARIF file for diagnostics" | |
| if: always() | |
| uses: ./.github/actions/sarif | |
| with: | |
| REPO_VISIBILITY: ${{steps.visibility.outputs.is_public == 'true' && 'public' || 'private'}} |