feat(actionlint): cross-repo input validation for reusable workflows #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: actionlint | |
| # Lints GitHub Actions workflow YAML. | |
| # | |
| # Two roles: | |
| # 1. Self-CI for this repo — runs on PRs/pushes that touch | |
| # `.github/workflows/**` or `actions/**/action.yml`. Catches | |
| # input-contract regressions in the reusable workflows here | |
| # before they reach a caller as `startup_failure` at runtime | |
| # (platform-gitops#944). | |
| # 2. Reusable entry point — callers (service-template's `ci.yml` | |
| # and any onboarded repo) `uses:` this workflow to lint their | |
| # own `.github/workflows/`. | |
| # | |
| # actionlint itself doesn't fetch remote reusable workflows, so it | |
| # cannot cross-validate that a caller's input map matches this | |
| # repo's `workflow_call.inputs:` block. The companion job | |
| # `validate-reusable-inputs` below closes that gap (PG#1045) by | |
| # diffing every caller `with:` block against the referenced | |
| # workflow's declared `on.workflow_call.inputs` map. | |
| on: | |
| workflow_call: {} | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - '.github/workflows/**' | |
| - 'actions/**/action.yml' | |
| push: | |
| branches: [main] | |
| paths: | |
| - '.github/workflows/**' | |
| - 'actions/**/action.yml' | |
| # Pinned upstream release. Bump deliberately; actionlint occasionally | |
| # tightens rules in a way that flags previously-passing workflows. | |
| env: | |
| ACTIONLINT_VERSION: "1.7.7" | |
| jobs: | |
| actionlint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install actionlint | |
| run: | | |
| set -euo pipefail | |
| bash <(curl -fsSL \ | |
| "https://raw.githubusercontent.com/rhysd/actionlint/v${ACTIONLINT_VERSION}/scripts/download-actionlint.bash") \ | |
| "${ACTIONLINT_VERSION}" | |
| - name: Run actionlint | |
| run: ./actionlint -color | |
| # Cross-repo input validation for `uses: pinpredict/.github/...@ref` | |
| # callers. actionlint can't reach the remote workflow's | |
| # `workflow_call.inputs` map, so a renamed/removed input still surfaces | |
| # only at runtime as `startup_failure`. This job diffs caller `with:` | |
| # blocks against the referenced workflow and fails on unknown or | |
| # missing-required keys. No-op when the caller has no | |
| # `pinpredict/.github` reusable-workflow `uses:` lines. | |
| validate-reusable-inputs: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: pinpredict/.github/actions/validate-reusable-inputs@main |