verify.yml

# yaml-language-server:$schema=https://json.schemastore.org/github-workflow.json
# https://docs.github.com/en/actions/writing-workflows
name: Verify

# yamllint disable-line rule:truthy
on:
  push:
  pull_request:
  workflow_dispatch:
    inputs:
      butane:
        description: Run butane linter
        default: true
        type: boolean
      editorconfig:
        description: Run EditorConfig linter
        default: true
        type: boolean
      gitleaks:
        description: Run Gitleaks (Secret scanner)
        default: true
        type: boolean
      lychee:
        description: Run lychee (Broken link finder)
        default: true
        type: boolean
      markdownlint:
        description: Run Markdown linter
        default: true
        type: boolean
      shellcheck:
        description: Run shellcheck (shell script linter)
        default: true
        type: boolean
      taplo:
        description: Run taplo (TOML linter)
        default: true
        type: boolean
      yamllint:
        description: Run yamllint (YAML linter)
        default: true
        type: boolean

# https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
permissions:
  contents: read

# Cancel duplicate runs for this workflow if they happen for the same commit
# Thus should help with duplicate runs caused by PRs, e.g. because of Renovate
concurrency:
  group: ${{ github.workflow }}-${{ github.sha }}
  cancel-in-progress: true

jobs:
  butane:
    runs-on: ubuntu-latest
    if: ${{ inputs.butane || true }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Extract Tool Versions
        id: tool-versions
        run: |
          butane_version=$(grep -E 'butane = "v?[0-9]' .mise.toml | cut -d '=' -f2 | xargs)
          echo "butane_version=${butane_version}" >> "$GITHUB_OUTPUT"
      - name: Install butane
        env:
          BUTANE_VERSION: ${{ steps.tool-versions.outputs.butane_version }}
        run: |
          curl --fail --silent --show-error \
            --location "https://github.com/coreos/butane/releases/download/v${BUTANE_VERSION}/butane-x86_64-unknown-linux-gnu" \
            --output "butane"
          curl --fail --silent --show-error \
            --location "https://github.com/coreos/butane/releases/download/v${BUTANE_VERSION}/butane-x86_64-unknown-linux-gnu.asc" \
            --output "butane.asc"
          curl --silent --show-error "https://fedoraproject.org/fedora.gpg" --output "fedora.gpg"
          gpg --import "fedora.gpg"
          gpg --verify "butane.asc" "butane"
          chmod +x ./butane
          mv "butane" "/usr/local/bin/butane"
      - name: Run butane
        run: |
          find . -type f -name "*.bu.yaml" -o -name "*.bu.yml" | while read -r file; do
            echo "verifying ${file}"
            ./scripts/test.sh --bu-file "${file}"
          done
  editorconfig:
    runs-on: ubuntu-latest
    if: ${{ inputs.editorconfig || true }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Extract Tool Versions
        id: tool-versions
        run: |
          ec_version=$(grep -F 'editorconfig-checker' .mise.toml | cut -d '=' -f2 | cut -d '#' -f1 | xargs)
          ec_shasum=$(grep -F 'editorconfig-checker' .mise.toml | cut -d '=' -f3 | xargs)
          echo "ec_version=${ec_version}" >> "$GITHUB_OUTPUT"
          echo "ec_shasum=${ec_shasum}" >> "$GITHUB_OUTPUT"
      - name: Run EditorConfig Checker
        env:
          EDITORCONFIG_CHECKER_VERSION: ${{ steps.tool-versions.outputs.ec_version }}
          EDITORCONFIG_CHECKER_SHASUM: ${{ steps.tool-versions.outputs.ec_shasum }}
        run: |
          curl --fail --silent --show-error --location --output editorconfig.tar.gz \
            https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v${EDITORCONFIG_CHECKER_VERSION}/ec-linux-amd64.tar.gz
          echo "${EDITORCONFIG_CHECKER_SHASUM} editorconfig.tar.gz" | sha256sum --check
          tar -xzf editorconfig.tar.gz bin/ec-linux-amd64
          ./bin/ec-linux-amd64 -f github-actions
  gitleaks:
    runs-on: ubuntu-latest
    if: ${{ inputs.gitleaks || true }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Extract Tool Versions
        id: tool-versions
        run: |
          gitleaks_version=$(grep -F 'gitleaks' .mise.toml | cut -d '=' -f2 | cut -d '#' -f1 | xargs)
          gitleaks_shasum=$(grep -F 'gitleaks' .mise.toml | cut -d '=' -f3 | xargs)
          echo "gitleaks_version=${gitleaks_version}" >> "$GITHUB_OUTPUT"
          echo "gitleaks_shasum=${gitleaks_shasum}" >> "$GITHUB_OUTPUT"
      - name: Install Gitleaks
        env:
          GITLEAKS_VERSION: ${{ steps.tool-versions.outputs.gitleaks_version }}
          GITLEAKS_SHASUM: ${{ steps.tool-versions.outputs.gitleaks_shasum }}
        run: |
          curl --fail --silent --show-error --location --output gitleaks.tar.gz \
            https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz
          echo "${GITLEAKS_SHASUM} gitleaks.tar.gz" | sha256sum --check
          tar -xzf gitleaks.tar.gz gitleaks
          ./gitleaks dir --verbose --redact .
  lychee:
    runs-on: ubuntu-latest
    if: ${{ inputs.lychee || true }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Extract Tool Versions
        id: tool-versions
        run: |
          lychee_version=$(grep -F 'lychee' .mise.toml | cut -d '=' -f2 | cut -d '#' -f1 | xargs)
          echo "lychee_version=${lychee_version}" >> "$GITHUB_OUTPUT"
      - name: Restore lychee cache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: .lycheecache
          key: cache-lychee-${{ github.sha }}
          restore-keys: cache-lychee-
      - uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2.7.0
        with:
          fail: false
          failIfEmpty: false
          format: markdown
          jobSummary: true
          lycheeVersion: v${{ steps.tool-versions.outputs.lychee_version }}
          args: "--base . --cache --max-cache-age 21d ."
  markdownlint:
    runs-on: ubuntu-latest
    if: ${{ inputs.markdownlint || true }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: DavidAnson/markdownlint-cli2-action@07035fd053f7be764496c0f8d8f9f41f98305101 # v22.0.0
  shellcheck:
    runs-on: ubuntu-latest
    if: ${{ inputs.shellcheck || true }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Extract Tool Versions
        id: tool-versions
        run: |
          shellcheck_version=$(grep -F 'shellcheck' .mise.toml | cut -d '=' -f2 | cut -d '#' -f1 | xargs)
          echo "shellcheck_version=${shellcheck_version}" >> "$GITHUB_OUTPUT"
      - uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
        with:
          version: v${{ steps.tool-versions.outputs.shellcheck_version }}
  taplo:
    runs-on: ubuntu-latest
    if: ${{ inputs.taplo || true }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Extract Tool Versions
        id: tool-versions
        run: |
          taplo_version=$(grep -F 'taplo' .mise.toml | grep -v 'asdf' | cut -d '=' -f2 | cut -d '#' -f1 | xargs)
          taplo_shasum=$(grep -F 'taplo' .mise.toml | cut -d '=' -f3 | xargs)
          echo "taplo_version=${taplo_version}" >> "$GITHUB_OUTPUT"
          echo "taplo_shasum=${taplo_shasum}" >> "$GITHUB_OUTPUT"
      - name: Run Taplo
        env:
          TAPLO_VERSION: ${{ steps.tool-versions.outputs.taplo_version }}
          TAPLO_SHASUM: ${{ steps.tool-versions.outputs.taplo_shasum }}
        run: |
          curl --fail --silent --show-error --location --output taplo.gz \
            https://github.com/tamasfe/taplo/releases/download/${TAPLO_VERSION}/taplo-linux-x86_64.gz
          echo "${TAPLO_SHASUM} taplo.gz" | sha256sum --check
          gunzip --decompress taplo.gz
          chmod +x ./taplo
          ./taplo format --check --diff
          ./taplo check --default-schema-catalogs
  yamllint:
    runs-on: ubuntu-latest
    if: ${{ inputs.yamllint || true }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Run yamllint
        run: |
          pip install yamllint
          yamllint .