Lucas WintherandClaude Opus 5
a0e56c96b7
A lint gate on every push, a manual deploy form, and a connectivity workflow for when a deploy hangs instead of failing. Nothing deploys on a push: merging changes what would be deployed, a person still decides when. The stack name and pull policy reach a shell command, so they are validated through env: rather than interpolated into a run: block. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
74 lines
2.5 KiB
YAML
74 lines
2.5 KiB
YAML
---
|
|
# The static gate. Runs on every push and pull request, needs no access to any
|
|
# host, and is the definition of "done" for a change here.
|
|
#
|
|
# Everything below is `scripts/check.sh` plus two scans. Keeping the lint steps
|
|
# in a script rather than inline is deliberate: a contributor can run the exact
|
|
# same gate locally with `make check` before pushing, and the two cannot drift.
|
|
name: lint
|
|
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
pull_request:
|
|
|
|
# A second push to the same branch makes the first run pointless.
|
|
concurrency:
|
|
group: lint-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
ansible:
|
|
name: yamllint + ansible-lint + syntax
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
# scripts/check.sh is the single source of the version pins; it prints
|
|
# them so that this workflow can install exactly what a contributor runs
|
|
# locally. Nothing here can drift from the script.
|
|
- name: Install the pinned toolchain
|
|
run: |
|
|
set -eu
|
|
scripts/check.sh --print-specs | tee /dev/stderr | xargs -d '\n' pip install --quiet
|
|
|
|
- name: Run the static gate
|
|
run: RUNNER=installed scripts/check.sh
|
|
|
|
shell:
|
|
name: shellcheck
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
# Pre-installed on GitHub-hosted Ubuntu runners; installed explicitly so
|
|
# this job also works on a self-hosted runner with a bare image.
|
|
- name: Install shellcheck
|
|
run: command -v shellcheck || sudo apt-get install -y --no-install-recommends shellcheck
|
|
- name: Check the shell scripts
|
|
run: shellcheck scripts/*.sh server/*/*/app/*.sh
|
|
|
|
secrets:
|
|
name: secret scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
# detect scans history, not just the working tree. A secret that was
|
|
# committed and then removed is still a leaked secret.
|
|
fetch-depth: 0
|
|
# Run the upstream image directly rather than the marketplace action: the
|
|
# action requires a licence key for organisation-owned repositories, and
|
|
# silently no-ops without one. The image has no such condition.
|
|
- name: Scan the working tree and history for committed secrets
|
|
run: |
|
|
docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:latest \
|
|
detect --source=/repo --config=/repo/.gitleaks.toml \
|
|
--redact --verbose --no-banner
|