Skip to content

Commit 0e2f814

Browse files
martincostellomartincostello
authored
Extend linting (#1003)
- Add support for running CodeQL queries for GitHub Actions. - Add markdownlint. - Add PowerShell linting. - Fix lint warnings. - Bump actionlint to v1.7.7. - Add `filter` and `show-progress:false` to checkout options. - Use `${env:}` format to access environment variables for consistency. - Avoid interpolation. - Remove redundant quoting. - Use single quotes in YAML. - Refactor permissions.
1 parent 5bc4699 commit 0e2f814

18 files changed

+230
-115
lines changed

‎.github/ISSUE_TEMPLATE.md

+4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
title: ''
3+
---
4+
15
### Expected behaviour
26

37
<!-- Explain what you expected to happen. -->

‎.github/ISSUE_TEMPLATE/bug_report.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
name: Bug report
3+
title: Bug report
34
about: Create a bug report to help us improve the library
45
labels: bug
5-
66
---
77

88
### Describe the bug

‎.github/ISSUE_TEMPLATE/feature_request.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
---
22
name: Feature request
3+
title: Feature request
34
about: Suggest an idea for a feature of this library
45
labels: feature-request
5-
66
---
77

8-
### Is your feature request related to a problem? Please describe.
8+
### Is your feature request related to a problem?
99

1010
<!--
1111
A clear and concise description of what the problem is. For example: _It would be useful if [...]_

‎.github/workflows/approve-and-merge.yml

+34-24
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,18 @@ on:
55
branches: [ main, dotnet-vnext ]
66

77
env:
8+
POWERSHELL_YAML_VERSION: '0.4.12'
89
REVIEWER_LOGIN: ${{ vars.REVIEWER_USER_NAME }}
910

10-
permissions:
11-
contents: read
11+
permissions: {}
1212

1313
jobs:
1414
review-pull-request:
1515
runs-on: ubuntu-latest
16-
if: ${{ github.event.pull_request.user.login == vars.UPDATER_COMMIT_USER_NAME }}
16+
if: github.event.pull_request.user.login == vars.UPDATER_COMMIT_USER_NAME
17+
18+
permissions:
19+
contents: read
1720

1821
steps:
1922

@@ -23,31 +26,33 @@ jobs:
2326
with:
2427
application_id: ${{ secrets.REVIEWER_APPLICATION_ID }}
2528
application_private_key: ${{ secrets.REVIEWER_APPLICATION_PRIVATE_KEY }}
26-
permissions: "contents:write, pull_requests:write"
29+
permissions: 'contents:write, pull_requests:write'
2730

2831
- name: Install powershell-yaml
2932
shell: pwsh
30-
run: Install-Module -Name powershell-yaml -Force -MaximumVersion "0.4.7"
33+
run: Install-Module -Name powershell-yaml -Force -MaximumVersion ${env:POWERSHELL_YAML_VERSION}
3134

3235
- name: Check which dependencies were updated
3336
id: check-dependencies
3437
env:
3538
# This list of trusted package prefixes needs to stay in sync with include-nuget-packages in the update-dotnet-sdk workflow.
36-
INCLUDE_NUGET_PACKAGES: "Microsoft.AspNetCore.,Microsoft.EntityFrameworkCore.,Microsoft.Extensions.,Microsoft.NET.Test.Sdk"
39+
INCLUDE_NUGET_PACKAGES: 'Microsoft.AspNetCore.,Microsoft.EntityFrameworkCore.,Microsoft.Extensions.,Microsoft.NET.Test.Sdk'
3740
GH_TOKEN: ${{ steps.generate-application-token.outputs.token }}
41+
PR_NUMBER: ${{ github.event.pull_request.number }}
42+
UPDATER_COMMIT_USER_NAME: ${{ vars.UPDATER_COMMIT_USER_NAME }}
3843
shell: pwsh
3944
run: |
4045
# Replicate the logic in the dependabot/fetch-metadata action.
4146
# See https://github.com/dependabot/fetch-metadata/blob/aea2135c95039f05c64436f1d14638c300e10b2b/src/dependabot/update_metadata.ts#L29-L68.
4247
# Query the GitHub API to get the commits in the pull request.
4348
$commits = gh api `
44-
/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/commits `
49+
"/repos/${env:GITHUB_REPOSITORY}/pulls/${env:PR_NUMBER}/commits" `
4550
--jq '.[] | { author: .author.login, message: .commit.message }' | ConvertFrom-Json
4651
4752
# We should only approve pull requests that only contain commits from
4853
# the GitHub user we expected and only commits that contain the metadata
4954
# we need to determine what dependencies were updated by the other workflow.
50-
$expectedUser = "${{ vars.UPDATER_COMMIT_USER_NAME }}"
55+
$expectedUser = "${env:UPDATER_COMMIT_USER_NAME}"
5156
$onlyDependencyUpdates = $True
5257
$onlyChangesFromUser = $True
5358
@@ -82,7 +87,7 @@ jobs:
8287
# Did we find at least one dependency?
8388
$isPatch = $dependencies.Length -gt 0
8489
$onlyTrusted = $dependencies.Length -gt 0
85-
$trustedPackages = $env:INCLUDE_NUGET_PACKAGES.Split(',')
90+
$trustedPackages = ${env:INCLUDE_NUGET_PACKAGES}.Split(',')
8691
8792
foreach ($dependency in $dependencies) {
8893
$isPatch = $isPatch -And $dependency.Type -eq "version-update:semver-patch"
@@ -98,34 +103,38 @@ jobs:
98103
# Microsoft-published NuGet packages that were made by the GitHub
99104
# login we expect to make those changes in the other workflow.
100105
$isTrusted = (($onlyTrusted -And $isPatch) -And $onlyChangesFromUser) -And $onlyDependencyUpdates
101-
"is-trusted-update=$isTrusted" >> $env:GITHUB_OUTPUT
106+
"is-trusted-update=$isTrusted" >> ${env:GITHUB_OUTPUT}
102107
103108
- name: Checkout code
104109
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
110+
with:
111+
filter: 'tree:0'
112+
show-progress: false
105113

106114
# As long as it's not already approved, approve the pull request and enable auto-merge.
107115
# Our CI tests coupled with required statuses should ensure that the changes compile
108116
# and that the application is still functional after the update; any bug that might be
109117
# introduced by the update should be caught by the tests. If that happens, the build
110118
# workflow will fail and the preconditions for the auto-merge to happen won't be met.
111119
- name: Approve pull request and enable auto-merge
112-
if: ${{ steps.check-dependencies.outputs.is-trusted-update == 'true' }}
120+
if: steps.check-dependencies.outputs.is-trusted-update == 'true'
113121
env:
114122
GH_TOKEN: ${{ steps.generate-application-token.outputs.token }}
123+
PR_NUMBER: ${{ github.event.pull_request.number }}
115124
PR_URL: ${{ github.event.pull_request.html_url }}
116125
shell: pwsh
117126
run: |
118-
$approvals = gh api /repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/reviews | ConvertFrom-Json
119-
$approvals = $approvals | Where-Object { $_.user.login -eq $env:REVIEWER_LOGIN }
127+
$approvals = gh api "/repos/${env:GITHUB_REPOSITORY}/pulls/${env:PR_NUMBER}/reviews" | ConvertFrom-Json
128+
$approvals = $approvals | Where-Object { $_.user.login -eq ${env:REVIEWER_LOGIN} }
120129
$approvals = $approvals | Where-Object { $_.state -eq "APPROVED" }
121130
122131
if ($approvals.Length -eq 0) {
123-
gh pr checkout "$env:PR_URL"
124-
gh pr review --approve "$env:PR_URL"
125-
gh pr merge --auto --squash "$env:PR_URL"
132+
gh pr checkout ${env:PR_URL}
133+
gh pr review --approve ${env:PR_URL}
134+
gh pr merge --auto --squash ${env:PR_URL}
126135
}
127136
else {
128-
Write-Host "PR already approved.";
137+
Write-Output "PR already approved.";
129138
}
130139
131140
# If something was present in the pull request that isn't expected, then disable
@@ -134,27 +143,28 @@ jobs:
134143
# automatically if there's an unexpected change introduced. Any existing review
135144
# approvals that were made by the bot are also dismissed so human approval is required.
136145
- name: Disable auto-merge and dismiss approvals
137-
if: ${{ steps.check-dependencies.outputs.is-trusted-update != 'true' }}
146+
if: steps.check-dependencies.outputs.is-trusted-update != 'true'
138147
env:
139148
GH_TOKEN: ${{ steps.generate-application-token.outputs.token }}
149+
PR_NUMBER: ${{ github.event.pull_request.number }}
140150
PR_URL: ${{ github.event.pull_request.html_url }}
141151
shell: pwsh
142152
run: |
143-
$approvals = gh api /repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/reviews | ConvertFrom-Json
144-
$approvals = $approvals | Where-Object { $_.user.login -eq $env:REVIEWER_LOGIN }
153+
$approvals = gh api "/repos/${env:GITHUB_REPOSITORY}/pulls/${env:PR_NUMBER}/reviews" | ConvertFrom-Json
154+
$approvals = $approvals | Where-Object { $_.user.login -eq ${env:REVIEWER_LOGIN} }
145155
$approvals = $approvals | Where-Object { $_.state -eq "APPROVED" }
146156
147157
if ($approvals.Length -gt 0) {
148-
gh pr checkout "$env:PR_URL"
149-
gh pr merge --disable-auto "$env:PR_URL"
158+
gh pr checkout ${env:PR_URL}
159+
gh pr merge --disable-auto ${env:PR_URL}
150160
foreach ($approval in $approvals) {
151161
gh api `
152162
--method PUT `
153-
/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/reviews/$($approval.id)/dismissals `
163+
"/repos/${env:GITHUB_REPOSITORY}/pulls/${env:PR_NUMBER}/reviews/$($approval.id)/dismissals" `
154164
-f message='Cannot approve as other changes have been introduced.' `
155165
-f event='DISMISS'
156166
}
157167
}
158168
else {
159-
Write-Host "PR not already approved.";
169+
Write-Output "PR not already approved.";
160170
}

‎.github/workflows/build.yml

+6-1
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,9 @@ jobs:
4747

4848
- name: Checkout code
4949
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
50+
with:
51+
filter: 'tree:0'
52+
show-progress: false
5053

5154
- name: Setup .NET SDK
5255
uses: actions/setup-dotnet@3951f0dfe7a07e2313ec93c75700083e2005cbab # v4.3.0
@@ -152,4 +155,6 @@ jobs:
152155
dotnet-version: ${{ needs.build.outputs.dotnet-sdk-version }}
153156

154157
- name: Push NuGet packages to NuGet.org
155-
run: dotnet nuget push "*.nupkg" --api-key ${{ secrets.NUGET_TOKEN }} --skip-duplicate --source https://api.nuget.org/v3/index.json
158+
run: dotnet nuget push "*.nupkg" --api-key "${NUGET_API_KEY}" --skip-duplicate --source https://api.nuget.org/v3/index.json
159+
env:
160+
NUGET_API_KEY: ${{ secrets.NUGET_TOKEN }}

‎.github/workflows/bump-version.yml

+7-5
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ jobs:
3434
- name: Checkout code
3535
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3636
with:
37+
filter: 'tree:0'
38+
show-progress: false
3739
token: ${{ steps.generate-application-token.outputs.token }}
3840

3941
- name: Bump version
@@ -75,7 +77,7 @@ jobs:
7577
7678
"" >> $properties
7779
78-
"version=${updatedVersion}" >> $env:GITHUB_OUTPUT
80+
"version=${updatedVersion}" >> ${env:GITHUB_OUTPUT}
7981
8082
- name: Push changes to GitHub
8183
id: push-changes
@@ -102,7 +104,7 @@ jobs:
102104
git rev-parse --verify --quiet "remotes/origin/${branchName}" | Out-Null
103105
104106
if ($LASTEXITCODE -eq 0) {
105-
Write-Host "Branch ${branchName} already exists."
107+
Write-Output "Branch ${branchName} already exists."
106108
exit 0
107109
}
108110
@@ -111,9 +113,9 @@ jobs:
111113
git commit -m "Bump version`n`nBump version to ${env:NEXT_VERSION} for the next release."
112114
git push -u origin $branchName
113115
114-
"branch-name=${branchName}" >> $env:GITHUB_OUTPUT
115-
"updated-version=true" >> $env:GITHUB_OUTPUT
116-
"version=${env:NEXT_VERSION}" >> $env:GITHUB_OUTPUT
116+
"branch-name=${branchName}" >> ${env:GITHUB_OUTPUT}
117+
"updated-version=true" >> ${env:GITHUB_OUTPUT}
118+
"version=${env:NEXT_VERSION}" >> ${env:GITHUB_OUTPUT}
117119
118120
- name: Create pull request
119121
if: steps.push-changes.outputs.updated-version == 'true'

‎.github/workflows/code-scan.yml

-37
This file was deleted.

‎.github/workflows/codeql.yml

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: codeql
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
pull_request:
7+
branches:
8+
- main
9+
- dotnet-vnext
10+
- dotnet-nightly
11+
schedule:
12+
- cron: '0 6 * * MON'
13+
workflow_dispatch:
14+
15+
permissions: {}
16+
17+
jobs:
18+
analysis:
19+
runs-on: ubuntu-latest
20+
21+
permissions:
22+
actions: read
23+
contents: read
24+
security-events: write
25+
26+
strategy:
27+
fail-fast: false
28+
matrix:
29+
language: [ 'actions', 'csharp' ]
30+
31+
steps:
32+
- name: Checkout repository
33+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
34+
with:
35+
filter: 'tree:0'
36+
show-progress: false
37+
38+
- name: Initialize CodeQL
39+
uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
40+
with:
41+
build-mode: none
42+
languages: ${{ matrix.language }}
43+
44+
- name: Perform CodeQL Analysis
45+
uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
46+
with:
47+
category: /language:${{ matrix.language }}
48+
49+
codeql:
50+
if: ${{ !cancelled() }}
51+
needs: [ analysis ]
52+
runs-on: ubuntu-latest
53+
54+
steps:
55+
- name: Report status
56+
shell: bash
57+
env:
58+
SCAN_SUCCESS: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
59+
run: |
60+
if [ "${SCAN_SUCCESS}" == "true" ]
61+
then
62+
echo 'CodeQL analysis successful ✅'
63+
else
64+
echo '::error title=CodeQL::CodeQL analysis failed ❌'
65+
exit 1
66+
fi

‎.github/workflows/dependabot-approve.yml

+9-4
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,15 @@ name: dependabot-approve
22

33
on: pull_request_target
44

5-
permissions:
6-
contents: read
5+
permissions: {}
76

87
jobs:
98
dependabot:
109
runs-on: ubuntu-latest
11-
if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
10+
if: github.event.pull_request.user.login == 'dependabot[bot]'
11+
12+
permissions:
13+
contents: read
1214

1315
steps:
1416

@@ -22,10 +24,13 @@ jobs:
2224
with:
2325
application_id: ${{ secrets.REVIEWER_APPLICATION_ID }}
2426
application_private_key: ${{ secrets.REVIEWER_APPLICATION_PRIVATE_KEY }}
25-
permissions: "contents:write, pull_requests:write"
27+
permissions: 'contents:write, pull_requests:write'
2628

2729
- name: Checkout code
2830
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
31+
with:
32+
filter: 'tree:0'
33+
show-progress: false
2934

3035
- name: Approve pull request and enable auto-merge
3136
shell: bash

0 commit comments

Comments
 (0)