fix: reject empty interior domain labels #432
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint | |
| on: | |
| push: | |
| branches: ["main"] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| golangci-core: | |
| name: "Go: core" | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: golangci-lint | |
| - name: 🏗️ Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| - name: 📡 Run `go telemetry on` | |
| run: | | |
| go telemetry on | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🧹 Run golangci-lint | |
| uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 | |
| with: | |
| version: v2.12.2 | |
| golangci-scripts: | |
| name: "Go: scripts (${{ matrix.module.name }})" | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| module: | |
| - name: "doc watch" | |
| directory: scripts/github-actions/cloudflare-doc-watch | |
| - name: "auth error watch" | |
| directory: scripts/github-actions/cloudflare-auth-error-watch | |
| - name: "link check" | |
| directory: scripts/github-actions/link-check | |
| - name: "smoke test" | |
| directory: scripts/github-actions/smoke-test | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: golangci-lint | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🏗️ Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| cache-dependency-path: ${{ matrix.module.directory }}/go.mod | |
| - name: 📡 Run `go telemetry on` | |
| run: | | |
| go telemetry on | |
| - name: 🧹 Run golangci-lint | |
| uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 | |
| with: | |
| version: v2.12.2 | |
| working-directory: ${{ matrix.module.directory }} | |
| actionlint: | |
| name: GitHub Actions (actionlint) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: go-tooling | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🏗️ Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| - name: 📡 Run `go telemetry on` | |
| run: | | |
| go telemetry on | |
| - name: 🔎 Check shellcheck availability | |
| run: | | |
| command -v shellcheck | |
| - name: 🧹 Run actionlint | |
| run: | | |
| go install "github.com/rhysd/actionlint/cmd/actionlint@${ACTIONLINT_VERSION}" | |
| actionlint -shellcheck shellcheck | |
| continue-on-error: false | |
| env: | |
| # renovate: datasource=go depName=github.com/rhysd/actionlint versioning=semver | |
| ACTIONLINT_VERSION: v1.7.12 | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| zizmor: | |
| name: GitHub Actions (zizmor) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: github-hosted-tooling | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🧹 Run zizmor | |
| uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1 | |
| hadolint: | |
| name: Dockerfile | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: github-hosted-tooling | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🧹 Run hadolint | |
| uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 | |
| with: | |
| dockerfile: Dockerfile | |
| yamlfmt: | |
| name: YAML | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: go-tooling | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🏗️ Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.5" | |
| - name: 📡 Run `go telemetry on` | |
| run: | | |
| go telemetry on | |
| - name: 🧹 Run yamlfmt | |
| run: | | |
| go install "github.com/google/yamlfmt/cmd/yamlfmt@${YAMLFMT_VERSION}" | |
| yamlfmt . | |
| env: | |
| # renovate: datasource=go depName=github.com/google/yamlfmt versioning=semver | |
| YAMLFMT_VERSION: v0.21.0 | |
| jq: | |
| name: JSON | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: github-hosted-tooling | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🧹 Run jq | |
| run: | | |
| status=0 | |
| while IFS= read -r -d '' file; do | |
| tmp="$(mktemp)" | |
| if ! jq --indent 2 . "$file" >"$tmp"; then | |
| echo "Invalid JSON: $file" >&2 | |
| rm -f "$tmp" | |
| status=1 | |
| continue | |
| fi | |
| if ! diff -u "$file" "$tmp" >/dev/null; then | |
| echo "Not formatted: $file" >&2 | |
| status=1 | |
| fi | |
| rm -f "$tmp" | |
| done < <(git ls-files -z '*.json') | |
| exit "$status" | |
| mdformat: | |
| name: Markdown | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: 🛡️ Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| policy: python-tooling | |
| - name: 🚚 Check out the repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🐍 Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.14" | |
| cache: pip | |
| cache-dependency-path: .github/workflows/mdformat-requirements.txt | |
| - name: 📦 Install mdformat | |
| run: python -m pip install --require-hashes --requirement .github/workflows/mdformat-requirements.txt | |
| - name: 🧹 Run mdformat | |
| run: git ls-files -z '*.md' '*.markdown' | xargs -0r python -m mdformat --check |