pr-lint.yml

--- # Linting of pull requests
# Maintain in repo: funfair-server-template
name: "PR: Lint"
on:
  pull_request:
    types: [opened, edited, synchronize, reopened, ready_for_review, unlocked]
    branches:
      - main

permissions:
  contents: read
  pull-requests: read

concurrency:
  group: ${{github.workflow}}-${{github.ref}}
  cancel-in-progress: true

env:
  HEAD_REF: ${{github.head_ref}}
  BASE_REF: ${{github.base_ref}}

jobs:
  info:
    if: endsWith(github.repository, '-template')
    runs-on: [self-hosted, linux, build]
    steps:
      - name: "Initialise Workspace"
        if: runner.environment == 'self-hosted'
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Set Active Environment"
        shell: bash
        run: |
          {
            echo "ACTIVE_RUNNER_NAME=${{runner.name}}"
            echo "ACTIVE_HOSTNAME=$HOSTNAME"
            echo "ACTIVE_USER=$USER"
          } >> "$GITHUB_ENV"

      - name: "Info"
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            core.info(`Branch: ${process.env.HEAD_REF}`);
            core.info(`Base Branch: ${process.env.BASE_REF}`);
            core.info(`Repo: ${context.repo.owner}/${context.repo.repo}`);
            core.info(`Owner: ${context.repo.owner}`);

            await core.summary
              .addHeading('Info')
              .addTable([
                [{data: 'Property', header: true}, {data: 'Value', header: true}],
                ['Branch', `${process.env.HEAD_REF}`],
                ['Base Branch', `${process.env.BASE_REF}`],
                ['Repo', `${context.repo.owner}/${context.repo.repo}`],
                ['Owner', `${context.repo.owner}`],
              ])
              .write();
  # @@required: merge
  include-changelog-entry:
    if: |-
      github.event.pull_request.draft == false &&
      !contains(github.event.pull_request.labels.*.name, 'Changelog Not Required')
    runs-on: [self-hosted, linux, build]
    steps:
      - name: "Initialise Workspace"
        if: runner.environment == 'self-hosted'
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Set Active Environment"
        shell: bash
        run: |
          {
            echo "ACTIVE_RUNNER_NAME=${{runner.name}}"
            echo "ACTIVE_HOSTNAME=$HOSTNAME"
            echo "ACTIVE_USER=$USER"
          } >> "$GITHUB_ENV"

      - name: "Checkout Source"
        if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template'))
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          clean: true
          fetch-depth: 0

      - name: "Diff Changes"
        if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template'))
        shell: bash
        run: |
          diff_output=$(git diff --exit-code --no-patch --merge-base "origin/${BASE_REF}" CHANGELOG.md 2>&1) && diff_exit=0 || diff_exit=$?

          case "${diff_exit}" in
            0|1)
              echo "CHANGES=${diff_exit}" >> "$GITHUB_ENV"
              ;;
            *)
              echo "::error::git diff against origin/${BASE_REF} failed (exit ${diff_exit}): ${diff_output}"
              exit "${diff_exit}"
              ;;
          esac

      - name: "Report unchanged"
        if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template')) && env.CHANGES == '0'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            core.setFailed('Changelog has not changed')

  change-log-entry-is-in-unreleased:
    if: github.event.pull_request.draft == false
    # As LibGit2Sharp doesn't work on 20.04
    runs-on: [self-hosted, linux, build]
    steps:
      - name: "Initialise Workspace"
        if: runner.environment == 'self-hosted'
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Set Active Environment"
        shell: bash
        run: |
          {
            echo "ACTIVE_RUNNER_NAME=${{runner.name}}"
            echo "ACTIVE_HOSTNAME=$HOSTNAME"
            echo "ACTIVE_USER=$USER"
          } >> "$GITHUB_ENV"

      - name: "Checkout Source"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          clean: true
          fetch-depth: 0

      - name: "Check Required Secrets"
        if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template'))
        uses: ./.github/actions/check-required-secret
        with:
          secret-name: "SOURCE_PUSH_TOKEN"
          secret-value: ${{secrets.SOURCE_PUSH_TOKEN}}

      - name: "Install dotnet"
        if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template'))
        uses: ./.github/actions/dotnet-install
        with:
          github-token: ${{secrets.SOURCE_PUSH_TOKEN}}
          nuget-public-restore-feed-cache: ${{vars.NUGET_BAGET_CACHE}}
          nuget-public-restore-feed: ${{vars.NUGET_PUBLIC_RESTORE_FEED || 'https://api.nuget.org/v3/index.json'}}
          nuget-additional-restore-feed-release-cache: ""
          nuget-additional-restore-feed-prerelease-cache: ""
          nuget-additional-restore-feed-release: ""
          nuget-additional-restore-feed-prerelease: ""

      - name: "Install Changelog tool"
        if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template'))
        uses: ./.github/actions/dotnet-tool
        with:
          tool-name: "Credfeto.ChangeLog.Cmd"
          tool-version: "latest"

      - name: "Check Changelog"
        if: (github.actor != 'dependabot[bot]' && !endsWith(github.repository , '-template'))
        uses: ./.github/actions/dotnet-tool-run
        with:
          working-directory: ${{github.workspace}}
          tool-name: "changelog"
          tool-arguments: "--changelog \"${{github.workspace}}/CHANGELOG.md\" --check-insert \"origin/${{github.base_ref}}\""

  # @@required: merge
  does-not-contain-secrets:
    if: github.event.pull_request.draft == false
    runs-on: [self-hosted, linux, build]
    steps:
      - name: "Initialise Workspace"
        if: runner.environment == 'self-hosted'
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Set Active Environment"
        shell: bash
        run: |
          {
            echo "ACTIVE_RUNNER_NAME=${{runner.name}}"
            echo "ACTIVE_HOSTNAME=$HOSTNAME"
            echo "ACTIVE_USER=$USER"
          } >> "$GITHUB_ENV"

      - name: "Checkout Source"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          clean: true
          fetch-depth: 0

      - name: "Check for leaks"
        uses: trufflesecurity/trufflehog@bcfcf73aaf4759d4dadc2783177c245a02792318 # v3.97.0
        id: trufflehog
        with:
          path: "${{ github.workspace }}"
          base: "${{ github.event.repository.default_branch }}"
          head: HEAD
          extra_args: --debug --only-verified

      - name: "Scan Results Status"
        if: steps.trufflehog.outcome == 'failure'
        run: exit 1

  # @@required: merge
  has-no-merge-conflicts:
    if: github.event.pull_request.draft == false
    runs-on: [self-hosted, linux, build]
    steps:
      - name: "Initialise Workspace"
        if: runner.environment == 'self-hosted'
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Set Active Environment"
        shell: bash
        run: |
          {
            echo "ACTIVE_RUNNER_NAME=${{runner.name}}"
            echo "ACTIVE_HOSTNAME=$HOSTNAME"
            echo "ACTIVE_USER=$USER"
          } >> "$GITHUB_ENV"

      - name: "Checkout Source"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          clean: true
          fetch-depth: 1

      - name: "Check for merge conflicts"
        uses: ./.github/actions/check-no-merge-conflicts

  # @@required: merge
  has-no-file-or-folder-case-sensitivity-issues:
    if: github.event.pull_request.draft == false
    runs-on: [self-hosted, linux, build]
    steps:
      - name: "Initialise Workspace"
        if: runner.environment == 'self-hosted'
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Set Active Environment"
        shell: bash
        run: |
          {
            echo "ACTIVE_RUNNER_NAME=${{runner.name}}"
            echo "ACTIVE_HOSTNAME=$HOSTNAME"
            echo "ACTIVE_USER=$USER"
          } >> "$GITHUB_ENV"

      - name: "Checkout Source"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          clean: true
          fetch-depth: 1

      - name: "Check for case conflicts"
        uses: ./.github/actions/check-no-case-sensitivity-conflicts

  # @@required: merge
  no-ignored-files:
    if: github.event.pull_request.draft == false
    runs-on: [self-hosted, linux, build]
    steps:
      - name: "Initialise Workspace"
        if: runner.environment == 'self-hosted'
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Set Active Environment"
        shell: bash
        run: |
          {
            echo "ACTIVE_RUNNER_NAME=${{runner.name}}"
            echo "ACTIVE_HOSTNAME=$HOSTNAME"
            echo "ACTIVE_USER=$USER"
          } >> "$GITHUB_ENV"

      - name: "Checkout Source"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          clean: true
          fetch-depth: 1

      - name: "Check for ignored files"
        uses: ./.github/actions/check-no-ignored-files

  # @@required: merge
  dependency-review:
    # Check that there are no dependencies with security problems in the PR
    if: github.event.pull_request.draft == false
    runs-on: [self-hosted, linux, build]
    steps:
      - name: "Initialise Workspace"
        if: runner.environment == 'self-hosted'
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Set Active Environment"
        shell: bash
        run: |
          {
            echo "ACTIVE_RUNNER_NAME=${{runner.name}}"
            echo "ACTIVE_HOSTNAME=$HOSTNAME"
            echo "ACTIVE_USER=$USER"
          } >> "$GITHUB_ENV"

      - name: "Checkout Source"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          clean: true
          fetch-depth: 1

      - name: "Check repo visibility"
        uses: ./.github/actions/check-repo-visibility
        id: visibility

      - name: "Dependency Review"
        if: steps.visibility.outputs.is_public == 'true'
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

  no-merge-commits:
    # Check that there are no merge commits in the PR
    if: github.event.pull_request.draft == false
    runs-on: [self-hosted, linux, build]
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: "Initialise Workspace"
        if: runner.environment == 'self-hosted'
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Set Active Environment"
        shell: bash
        run: |
          {
            echo "ACTIVE_RUNNER_NAME=${{runner.name}}"
            echo "ACTIVE_HOSTNAME=$HOSTNAME"
            echo "ACTIVE_USER=$USER"
          } >> "$GITHUB_ENV"

      - name: "Checkout Source"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          clean: true
          fetch-depth: 1

      - name: "Check for merge commits"
        uses: ./.github/actions/check-no-merge-commits

  valid-changelog:
    if: github.event.pull_request.draft == false
    runs-on: [self-hosted, linux, build]
    steps:
      - name: "Initialise Workspace"
        if: runner.environment == 'self-hosted'
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Set Active Environment"
        shell: bash
        run: |
          {
            echo "ACTIVE_RUNNER_NAME=${{runner.name}}"
            echo "ACTIVE_HOSTNAME=$HOSTNAME"
            echo "ACTIVE_USER=$USER"
          } >> "$GITHUB_ENV"

      - name: "Checkout Source"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          clean: true
          fetch-depth: 1

      - name: "Check Required Secrets"
        uses: ./.github/actions/check-required-secret
        with:
          secret-name: "SOURCE_PUSH_TOKEN"
          secret-value: ${{secrets.SOURCE_PUSH_TOKEN}}

      - name: "Install dotnet"
        uses: ./.github/actions/dotnet-install
        with:
          github-token: ${{secrets.SOURCE_PUSH_TOKEN}}
          nuget-public-restore-feed-cache: ${{vars.NUGET_BAGET_CACHE}}
          nuget-public-restore-feed: ${{vars.NUGET_PUBLIC_RESTORE_FEED || 'https://api.nuget.org/v3/index.json'}}
          nuget-additional-restore-feed-release-cache: ""
          nuget-additional-restore-feed-prerelease-cache: ""
          nuget-additional-restore-feed-release: ""
          nuget-additional-restore-feed-prerelease: ""

      - name: "Install Changelog tool"
        uses: ./.github/actions/dotnet-tool
        with:
          tool-name: "Credfeto.ChangeLog.Cmd"
          tool-version: "latest"

      - name: "Check Changelog"
        uses: ./.github/actions/dotnet-tool-run
        with:
          working-directory: ${{github.workspace}}
          tool-name: "changelog"
          tool-arguments: "--changelog \"${{github.workspace}}/CHANGELOG.md\" --lint"

  # @@required: main
  lint-code:
    if: |-
      github.event.pull_request.draft == false &&
      ( !startsWith(github.head_ref, 'release/') && !startsWith(github.head_ref, 'hotfix/') )
    runs-on: [self-hosted, linux, build]
    steps:
      - name: "Initialise Workspace"
        if: runner.environment == 'self-hosted'
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Set Active Environment"
        shell: bash
        run: |
          {
            echo "ACTIVE_RUNNER_NAME=${{runner.name}}"
            echo "ACTIVE_HOSTNAME=$HOSTNAME"
            echo "ACTIVE_USER=$USER"
          } >> "$GITHUB_ENV"

      - name: "Checkout Source"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          clean: true
          fetch-depth: 0

      - name: "Check Required Secrets"
        uses: ./.github/actions/check-required-secret
        with:
          secret-name: "SOURCE_PUSH_TOKEN"
          secret-value: ${{secrets.SOURCE_PUSH_TOKEN}}

      - name: "Run Linter"
        uses: super-linter/super-linter@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
        env:
          CLOUDFORMATION_CONFIG_FILE: .cfnlintrc.yaml
          DEFAULT_BRANCH: main
          ENABLE_GITHUB_ACTIONS_STEP_SUMMARY: true
          GITHUB_ACTIONS_CONFIG_FILE: actionlint.yaml
          GITHUB_TOKEN: ${{secrets.SOURCE_PUSH_TOKEN}}
          MULTI_STATUS: true
          SAVE_SUPER_LINTER_SUMMARY: true
          SQLFLUFF_CONFIG_FILE: .sqlfluff
          VALIDATE_ALL_CODEBASE: false
          VALIDATE_ANSIBLE: true
          VALIDATE_BASH: true
          VALIDATE_CLOUDFORMATION: true
          VALIDATE_CSS: true
          VALIDATE_DOCKERFILE: true
          VALIDATE_DOCKERFILE_HADOLINT: true
          VALIDATE_ENV: true
          VALIDATE_GITHUB_ACTIONS: true
          VALIDATE_JSON: true
          VALIDATE_MD: true
          VALIDATE_POWERSHELL: true
          VALIDATE_PYTHON: true
          VALIDATE_PYTHON_PYLINT: true
          VALIDATE_SQLFLUFF: true
          VALIDATE_TYPESCRIPT_ES: true
          VALIDATE_XML: true
          VALIDATE_YAML: true

  # @@required: main
  poutine:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
      pull-requests: write
    steps:
      - name: "Initialise Workspace"
        if: runner.environment == 'self-hosted'
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Checkout Source"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: "Check repo visibility"
        uses: ./.github/actions/check-repo-visibility
        id: visibility

      - name: "Ensure Results folder exists"
        working-directory: ${{github.workspace}}
        shell: bash
        run: |
          [ ! -d "${{github.workspace}}/results" ] && mkdir "${{github.workspace}}/results" || echo "Results created"

      - name: "Poutine"
        uses: boostsecurityio/poutine-action@e240ebd3eff8b2db5a8e5f6b28f58739d7db2247 # v1.1.4
        with:
          format: 'sarif'
          output: "${{github.workspace}}/results/poutine.sarif"

      - name: "Summarise Poutine findings"
        uses: ./.github/actions/sarif-summary
        with:
          title: "Poutine findings"
          glob: "poutine.sarif"

      ############################################################################################################
      # Upload Sarif files to GitHub
      ############################################################################################################
      - name: "Upload SARIF file for diagnostics"
        if: always()
        uses: ./.github/actions/sarif
        with:
          repo-visibility: ${{steps.visibility.outputs.is_public == 'true' && 'public' || 'private'}}