pre-submit.lint.yml

# Copyright 2023 SLSA Authors
# Copyright 2026 StepSecurity
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Lint

on:
  push:
    branches: [main, "*"]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [main]
  workflow_dispatch:

permissions:
  # Needed to check out the repo.
  contents: read

jobs:
  formatting:
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
          go-version: "1.22.3"
      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
        with:
          node-version: 22

      - name: Install gofumpt
        run: go install mvdan.cc/gofumpt@v0.6.0

      - name: Install shfmt
        env:
          SHFMT_VERSION: "3.8.0"
          SHFMT_CHECKSUM: "27b3c6f9d9592fc5b4856c341d1ff2c88856709b9e76469313642a1d7b558fe0"
        run: |
          set -euo pipefail

          #Install golangci-lint
          curl -sSLo shfmt "https://github.com/mvdan/sh/releases/download/v${SHFMT_VERSION}/shfmt_v${SHFMT_VERSION}_linux_amd64"
          echo "shfmt checksum is $(sha256sum shfmt | awk '{ print $1 }')"
          echo "expected checksum is ${SHFMT_CHECKSUM}"
          echo "${SHFMT_CHECKSUM}  shfmt" | sha256sum --strict --check --status || exit 1
          chmod +x shfmt
          mv shfmt /usr/local/bin

      - run: make format
      - name: Check for unformatted files
        id: diff
        run: |
          set -euo pipefail
          if [ "$(git diff --ignore-space-at-eol . | wc -l)" -gt "0" ]; then
            echo "Detected uncommitted changes after formatting."
            echo "Run 'make format' to format files in your PR."
            echo "See status below:"
            git diff
            exit 1
          fi

  shellcheck:
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: shellcheck
        env:
          SHELLCHECK_VERSION: "0.10.0"
          SHELLCHECK_CHECKSUM: "6c881ab0698e4e6ea235245f22832860544f17ba386442fe7e9d629f8cbedf87"
        run: |
          set -euo pipefail

          # Install shellcheck
          curl -sSLo shellcheck.tar.gz "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
          echo "shellcheck checksum is $(sha256sum shellcheck.tar.gz | awk '{ print $1 }')"
          echo "expected checksum is $SHELLCHECK_CHECKSUM"
          echo "$SHELLCHECK_CHECKSUM  shellcheck.tar.gz" | sha256sum --strict --check --status || exit 1

          tar xf shellcheck.tar.gz
          mv "shellcheck-v${SHELLCHECK_VERSION}/shellcheck" /usr/local/bin

          make shellcheck

      - name: actionlint
        env:
          ACTIONLINT_VERSION: "1.7.12"
          ACTIONLINT_CHECKSUM: "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8"
        run: |
          set -euo pipefail

          # Install actionlint
          curl -sSLo actionlint.tar.gz "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          echo "actionlint checksum is $(sha256sum actionlint.tar.gz | awk '{ print $1 }')"
          echo "expected checksum is $ACTIONLINT_CHECKSUM"
          echo "$ACTIONLINT_CHECKSUM  actionlint.tar.gz" | sha256sum --strict --check --status || exit 1

          tar xf actionlint.tar.gz
          mv ./actionlint /usr/local/bin

          make actionlint

  yamllint:
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: |
          set -euo pipefail

          # Install yamllint
          pip install -r requirements.txt --require-hashes

          # Run yamllint
          make yamllint

  eslint:
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
      - run: make eslint