linting.yml

---
name: Linting

on:
  pull_request:

permissions: {}

jobs:
  apply-suggestions-commits:
    name: 'No "Apply suggestions from code review" Commits'
    runs-on: ubuntu-latest
    steps:
      - name: Get PR commits
        id: 'get-pr-commits'
        uses: tim-actions/get-pr-commits@3efc1387ead42029a0d488ab98f24b7452dc3cde
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: 'Verify no "Apply suggestions from code review" commits'
        uses: tim-actions/commit-message-checker-with-regex@e16b08b1a7f5cafeb1f8167de05bf1d40239eb5d
        with:
          commits: ${{ steps.get-pr-commits.outputs.commits }}
          pattern: '^(?!.*(apply suggestions from code review))'
          flags: 'i'
          error: 'Commits addressing code review feedback should typically be squashed into the commits under review'

      - name: 'Verify no "fixup!" commits'
        uses: tim-actions/commit-message-checker-with-regex@e16b08b1a7f5cafeb1f8167de05bf1d40239eb5d
        with:
          commits: ${{ steps.get-pr-commits.outputs.commits }}
          pattern: '^(?!fixup!)'
          flags: 'i'
          error: 'Fixup commits should be squashed into the commits under review'

  code-gen:
    name: Submariner K8s API Code Generation
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - name: Run codegen
        run: make codegen
      - name: Ignore go.sum changes
        run: git checkout go.sum
      - name: Verify generated code matches committed code
        run: git add -A && git diff --staged --exit-code

  proto-gen:
    name: Protobuf Code Generation
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - name: Recreate Protobuf files
        run: find pkg -name '*.pb.go' -delete -exec make {} \;
      - name: Ignore go.sum changes
        run: git checkout go.sum
      - name: Verify generated code matches committed code
        run: git add -A && git diff -I'^//' --staged --exit-code

  gitlint:
    name: Commit Message(s)
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
        with:
          fetch-depth: 0
      - name: Run gitlint
        run: make gitlint

  golangci-lint:
    name: Go
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - name: Run golangci-lint
        run: make golangci-lint

  licenses:
    name: Dependency Licenses
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9

      - name: Check the licenses
        run: make licensecheck

  markdown-link-check:
    name: Markdown Links (modified files)
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9

      - name: Run markdown-link-check
        uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec
        with:
          config-file: ".markdownlinkcheck.json"
          check-modified-files-only: "yes"
          base-branch: ${{ github.base_ref }}

  markdownlint:
    name: Markdown
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - name: Run markdownlint
        run: make markdownlint

  packagedoc-lint:
    name: Package Documentation
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - name: Run packagedoc-lint
        run: make packagedoc-lint

  shellcheck:
    name: Shell
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - name: Run shellcheck
        run: make shellcheck

  vulnerability-scan:
    name: Vulnerability Scanning
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - name: Run Anchore vulnerability scanner
        uses: anchore/scan-action@24fd7c9060f3c96848dd1929fac8d796fb5ae4b4
        id: scan
        with:
          path: "."
          fail-build: true
          severity-cutoff: negligible
      - name: Show Anchore scan SARIF report
        if: always()
        run: cat ${{ steps.scan.outputs.sarif }}
      - name: Upload Anchore scan SARIF report
        if: always()
        uses: github/codeql-action/upload-sarif@f6e388ebf0efc915c6c5b165b019ee61a6746a38
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}

  yaml-lint:
    name: YAML
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - name: Run yamllint
        run: make yamllint