feat(setup-go): opt-in private-modules for unvendored private Go fetch #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: actionlint | |
| # Lints GitHub Actions workflow YAML. | |
| # | |
| # Two roles: | |
| # 1. Self-CI for this repo — runs on PRs/pushes that touch | |
| # `.github/workflows/**` or `actions/**/action.yml`. Catches | |
| # input-contract regressions in the reusable workflows here | |
| # before they reach a caller as `startup_failure` at runtime | |
| # (platform-gitops#944). | |
| # 2. Reusable entry point — callers (service-template's `ci.yml` | |
| # and any onboarded repo) `uses:` this workflow to lint their | |
| # own `.github/workflows/`. | |
| # | |
| # actionlint itself doesn't fetch remote reusable workflows, so it | |
| # cannot cross-validate that a caller's input map matches this | |
| # repo's `workflow_call.inputs:` block. The companion job | |
| # `validate-reusable-inputs` below closes that gap (PG#1045) by | |
| # diffing every caller `with:` block against the referenced | |
| # workflow's declared `on.workflow_call.inputs` map. | |
| on: | |
| workflow_call: {} | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - '.github/workflows/**' | |
| - 'actions/**/action.yml' | |
| push: | |
| branches: [main] | |
| paths: | |
| - '.github/workflows/**' | |
| - 'actions/**/action.yml' | |
| # Pinned upstream release. Bump deliberately; actionlint occasionally | |
| # tightens rules in a way that flags previously-passing workflows. | |
| env: | |
| ACTIONLINT_VERSION: "1.7.7" | |
| jobs: | |
| actionlint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install actionlint | |
| run: | | |
| set -euo pipefail | |
| bash <(curl -fsSL \ | |
| "https://raw.githubusercontent.com/rhysd/actionlint/v${ACTIONLINT_VERSION}/scripts/download-actionlint.bash") \ | |
| "${ACTIONLINT_VERSION}" | |
| - name: Run actionlint | |
| run: ./actionlint -color | |
| # Cross-repo input validation for `uses: pinpredict/.github/...@ref` | |
| # callers. actionlint can't reach the remote workflow's | |
| # `workflow_call.inputs` map, so a renamed/removed input still surfaces | |
| # only at runtime as `startup_failure`. This job diffs caller `with:` | |
| # blocks against the referenced workflow and fails on unknown or | |
| # missing-required keys. No-op when the caller has no | |
| # `pinpredict/.github` reusable-workflow `uses:` lines. | |
| validate-reusable-inputs: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout caller workflows | |
| uses: actions/checkout@v6 | |
| # `uses: ./...` in a reusable workflow resolves against the | |
| # caller's checkout, not this repo — so we vendor a copy of | |
| # pinpredict/.github and reference the action from there. | |
| # | |
| # Picking the right ref is the tricky part. Neither | |
| # `github.workflow_sha` nor `github.workflow_ref` exposes the | |
| # reusable workflow's own ref to a downstream caller: | |
| # - `workflow_sha` returns the caller's commit SHA. | |
| # - `workflow_ref` returns the caller's workflow file path, | |
| # e.g. `pinpredict/trading-reports/.github/workflows/ci.yml@refs/pull/5/merge`. | |
| # Both prior attempts (`73a31ca`, `31626de`) failed downstream | |
| # for this reason. | |
| # | |
| # Fall back to convention: per pinpredict/.github's CLAUDE.md, | |
| # downstream callers always pin `@main`, so checking out main | |
| # gets a downstream consumer the same action source the runner | |
| # already loaded for the workflow itself. For self-CI we use | |
| # `github.ref` so that PR-mode runs see the PR's version of the | |
| # action (refs/pull/N/merge), not main's. | |
| - name: Resolve workflow ref | |
| id: workflow-ref | |
| env: | |
| GITHUB_REPOSITORY: ${{ github.repository }} | |
| GITHUB_REF: ${{ github.ref }} | |
| run: | | |
| set -euo pipefail | |
| if [ "$GITHUB_REPOSITORY" = "pinpredict/.github" ]; then | |
| ref="$GITHUB_REF" | |
| else | |
| ref="refs/heads/main" | |
| fi | |
| printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT" | |
| - name: Checkout pinpredict/.github at workflow ref | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: pinpredict/.github | |
| ref: ${{ steps.workflow-ref.outputs.ref }} | |
| path: .pinpredict-github | |
| - uses: ./.pinpredict-github/actions/validate-reusable-inputs |