test-lint.yml

name: Lint

on:
  pull_request:

env:
  TURBO_REMOTE_ONLY: 'true'
  NODE_VERSION: '22'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  enforce-changeset:
    name: Enforce Changeset
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' && github.event.pull_request.title != 'Version Packages'
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: main
          token: ${{ secrets.GITHUB_TOKEN }}
      - run: git fetch origin ${{ github.event.pull_request.head.sha }}:pr-${{ github.event.pull_request.number }}
      - run: git checkout pr-${{ github.event.pull_request.number }}
      - name: install pnpm@10.29.3
        run: npm i -g pnpm@10.29.3
      - run: pnpm install
      # Enforce a changeset file to be present
      - run: pnpm exec changeset status --since=main

  lint:
    name: Lint
    timeout-minutes: 10
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' && github.event.pull_request.title != 'Version Packages'
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          # Check out the PR commit directly instead of a merge commit.
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Setup Turborepo Remote Cache
        uses: vercel/setup-turborepo-remote-cache-action@3df3d75a5268bbe2a4ee66048f56f3a86d6e21b7
        with:
          team: ${{ vars.TURBO_TEAM }}
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: '1.96.1'
          targets: wasm32-wasip2
      - name: install pnpm@10.29.3
        run: npm i -g pnpm@10.29.3
      - run: pnpm install
      - name: Biome lint
        run: pnpm run lint
      - name: Biome format check
        run: pnpm run format:check
      - name: Check dependency versions
        run: pnpm exec syncpack lint
      - run: pnpm run build
      - run: pnpm run type-check
      - name: Ensure clean git workspace
        run: git diff --name-only --exit-code

  lint-actions:
    name: Lint GitHub Actions
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - uses: actions/checkout@v4
        with:
          # Deliberately run against merge commit *here* because
          # github actions are sourced from the merge commits and I
          # don't think we can override that.
          ref:
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - run: python -m pip install pyyaml==6.0.3 zizmor==1.24.1
      - name: Enforce actions/checkout ref
        shell: python
        run: |
          import glob, sys, yaml

          errors = []
          for path in sorted(glob.glob(".github/workflows/*.yml")):
              with open(path) as f:
                  workflow = yaml.safe_load(f)
              if not isinstance(workflow, dict):
                  continue
              triggers = workflow.get(True) or {}  # 'on' parses as True in YAML
              if isinstance(triggers, list):
                  if "pull_request" not in triggers:
                      continue
              elif isinstance(triggers, dict):
                  if "pull_request" not in triggers:
                      continue
              else:
                  continue
              for job_name, job in workflow.get("jobs", {}).items():
                  for i, step in enumerate(job.get("steps") or []):
                      uses = step.get("uses", "")
                      if not uses.startswith("actions/checkout"):
                          continue
                      with_block = step.get("with") or {}
                      if "ref" not in with_block:
                          errors.append(
                              f"  {path}: job '{job_name}', step {i + 1} "
                              f"uses {uses} without a 'ref'"
                          )

          if errors:
              print("actions/checkout steps missing 'ref':")
              print("\n".join(errors))
              sys.exit(1)
          print("All actions/checkout steps have a 'ref' specified.")
      - name: Run zizmor
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: zizmor --collect=workflows --color=never .github/workflows/

  summary:
    name: Summary (lint)
    runs-on: ubuntu-latest
    timeout-minutes: 1
    if: always()
    needs:
      - enforce-changeset
      - lint
      - lint-actions
    steps:
      - name: Check All
        run: |-
          for status in ${{ join(needs.*.result, ' ') }}
          do
            if [ "$status" != "success" ] && [ "$status" != "skipped" ]
            then
              echo "Some checks failed"
              exit 1
            fi
          done