Pin GitHub Actions to full-length commit SHAs #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| actionlint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout (tarball) | |
| timeout-minutes: 5 | |
| env: | |
| REPO: ${{ github.repository }} | |
| SHA: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| url="https://codeload.github.com/${REPO}/tar.gz/${SHA}" | |
| curl -fsSL "${url}" -o repo.tar.gz | |
| topdir="$(tar -tzf repo.tar.gz | sed -n '1p' | cut -d/ -f1)" | |
| tar -xzf repo.tar.gz | |
| shopt -s dotglob | |
| mv "${topdir}"/* . | |
| rm -rf "${topdir}" repo.tar.gz | |
| - name: Setup Go | |
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 | |
| with: | |
| go-version: "1.22.x" | |
| - name: Install actionlint | |
| run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.10 | |
| - name: Lint GitHub Actions workflows | |
| run: | | |
| "$(go env GOPATH)/bin/actionlint" .github/workflows/*.yml | |
| terraform: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout (tarball) | |
| timeout-minutes: 5 | |
| env: | |
| REPO: ${{ github.repository }} | |
| SHA: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| url="https://codeload.github.com/${REPO}/tar.gz/${SHA}" | |
| curl -fsSL "${url}" -o repo.tar.gz | |
| topdir="$(tar -tzf repo.tar.gz | sed -n '1p' | cut -d/ -f1)" | |
| tar -xzf repo.tar.gz | |
| shopt -s dotglob | |
| mv "${topdir}"/* . | |
| rm -rf "${topdir}" repo.tar.gz | |
| - name: Setup Terraform | |
| uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3 | |
| with: | |
| terraform_version: 1.5.7 | |
| - name: Terraform fmt | |
| run: terraform -chdir=infrastructure fmt -check -recursive | |
| - name: Terraform init (no backend) | |
| run: terraform -chdir=infrastructure init -backend=false | |
| - name: Terraform validate | |
| run: terraform -chdir=infrastructure validate | |
| python: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout (tarball) | |
| timeout-minutes: 5 | |
| env: | |
| REPO: ${{ github.repository }} | |
| SHA: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| url="https://codeload.github.com/${REPO}/tar.gz/${SHA}" | |
| curl -fsSL "${url}" -o repo.tar.gz | |
| topdir="$(tar -tzf repo.tar.gz | sed -n '1p' | cut -d/ -f1)" | |
| tar -xzf repo.tar.gz | |
| shopt -s dotglob | |
| mv "${topdir}"/* . | |
| rm -rf "${topdir}" repo.tar.gz | |
| - name: Setup Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Python syntax check | |
| run: python -m compileall analysis scripts | |
| docs: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout (tarball) | |
| timeout-minutes: 5 | |
| env: | |
| REPO: ${{ github.repository }} | |
| SHA: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| url="https://codeload.github.com/${REPO}/tar.gz/${SHA}" | |
| curl -fsSL "${url}" -o repo.tar.gz | |
| topdir="$(tar -tzf repo.tar.gz | sed -n '1p' | cut -d/ -f1)" | |
| tar -xzf repo.tar.gz | |
| shopt -s dotglob | |
| mv "${topdir}"/* . | |
| rm -rf "${topdir}" repo.tar.gz | |
| - name: Setup Node | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: "22" | |
| cache: "npm" | |
| - name: Install Node deps | |
| run: npm ci | |
| - name: Build docs | |
| run: npm run docs:build |