642a5f7d96
Discovers files by shebang under scripts/ rather than a *.sh glob, so extensionless scripts (scripts/pre-push) and any future additions are covered without editing the workflow. Runs at -S warning: the repo's one existing finding (SC2016 on an intentionally single-quoted awk program) is info-level and correct as written, so it's excluded by severity rather than silenced with a disable comment. Refs #4429
100 lines
3.1 KiB
YAML
100 lines
3.1 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
branches: ["**"]
|
|
# Lets `hive-forge ci-rerun` re-trigger CI via workflow-dispatch API
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
check:
|
|
name: nix flake check
|
|
runs-on: [hive-ci]
|
|
# 30 min is well above a cold-cache rebuild (~15 min observed) and well
|
|
# under the runner's 3h cap
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: check
|
|
run: nix flake check
|
|
|
|
tracker-tags:
|
|
name: tracker-tag lint
|
|
runs-on: [hive-ci]
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: lint
|
|
run: sh scripts/check-issue-refs.sh
|
|
|
|
comment-blocks:
|
|
name: comment-block lint
|
|
runs-on: [hive-ci]
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: lint
|
|
run: sh scripts/check-comment-blocks.sh
|
|
|
|
doc-refs:
|
|
name: doc-pointer lint
|
|
runs-on: [hive-ci]
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: lint
|
|
run: sh scripts/check-doc-refs.sh
|
|
|
|
attribution-trailers:
|
|
name: attribution-trailer lint
|
|
runs-on: [hive-ci]
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
with:
|
|
fetch-depth: 0
|
|
- name: lint
|
|
run: sh scripts/check-attribution-trailers.sh
|
|
|
|
shellcheck:
|
|
name: shellcheck
|
|
runs-on: [hive-ci]
|
|
# shellcheck itself is fast; nix shell's first pull of the closure is
|
|
# the slow part on a cold cache.
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: lint
|
|
# Discovers raw shell files by shebang rather than by extension —
|
|
# scripts/pre-push ships with no `.sh` suffix, so a `*.sh` glob
|
|
# would silently skip it (and any future extensionless script).
|
|
# -S warning drops info-level notes: the repo's one SC2016 hit is
|
|
# an intentionally single-quoted awk program, not a bug, and this
|
|
# keeps the gate free of a disable-comment for it while still
|
|
# failing on anything warning-or-worse.
|
|
run: |
|
|
files=$(grep -lE '^#!.*/(env[[:space:]]+)?(ba)?sh([[:space:]]|$)' scripts/* 2>/dev/null)
|
|
echo "$files" | xargs nix develop -c shellcheck -S warning
|
|
|
|
prose-lint:
|
|
name: prose lint (vale)
|
|
runs-on: [hive-ci]
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: lint
|
|
# Styles are fetched fresh from Vale Package Hub each run (not vendored).
|
|
# Not wired into branch protection — see prose-lint-errors below for the
|
|
# error-only slice that is.
|
|
run: XDG_DATA_HOME="$PWD/.vale-data" nix shell nixpkgs#vale --command sh -c 'vale sync && vale docs'
|
|
|
|
prose-lint-errors:
|
|
name: prose lint (vale, errors)
|
|
runs-on: [hive-ci]
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: lint
|
|
# Error-level-only slice. Split out so this job alone can be a required
|
|
# check without blocking merges on the warning/suggestion backlog.
|
|
run: XDG_DATA_HOME="$PWD/.vale-data" nix shell nixpkgs#vale --command sh -c 'vale sync && vale --minAlertLevel=error docs'
|