ci: local CI testing with actionlint and act - #47
Merged
Conversation
Replace ls with find in publish.yml to resolve SC2012/SC2035 shellcheck warnings, enabling a clean actionlint pass. Add actionlint as a lefthook pre-commit command scoped to staged workflow files.
Create .actrc with ubuntu-24.04 runner mapping and amd64 container architecture for macOS arm64 compatibility. Add .secrets to .gitignore to prevent accidental token commits.
Guard steps that require GitHub API access or external secrets so they are cleanly skipped when running workflows locally via act. Affects: PR comment (tests.yml), LuaRocks upload (publish.yml), release-please action and artifact upload (release-please.yml).
Add act-test, act-lint, and act-publish recipes to the ci group. Each recipe targets a specific workflow and injects GITHUB_TOKEN from the local gh CLI session to avoid API rate limits.
Document the pre-commit hook table including the new actionlint hook, and add a "Local CI Verification (macOS)" section covering act prerequisites, Docker image setup, DOCKER_HOST configuration for Rancher Desktop, and the available just recipes.
The correct socket path is ~/.rd/docker.sock, not ~/.rd/run/docker.sock. The run/ subdirectory was never an official Rancher Desktop path.
Add --container-daemon-socket - to .actrc to prevent act from bind-mounting the Docker socket into containers. Our workflows don't need Docker-in-Docker, and the mount fails on Rancher Desktop / Colima where the socket is not at /var/run/docker.sock.
Corporate security proxies (Netskope, Zscaler) re-sign TLS certificates with their own CA, which containers don't trust. Set NODE_TLS_REJECT_UNAUTHORIZED=0 in .actrc so Node.js actions can reach GitHub APIs from inside act containers.
Accept main's per-platform upload steps (linux-x86_64 with rockspec, linux-aarch64, windows, macOS) from the CI matrix expansion and add !env.ACT guards to all four upload steps.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
publish.ymlby replacinglswithfindactconfiguration (.actrc) for running GitHub Actions workflows locally via Docker!env.ACTstep-level guards to skip API-dependent steps (PR comments, uploads, release-please) when running under actjust act-test,act-lint,act-publishrecipes for convenient local workflow executionTest plan
actionlintpasses with zero findingsjust --listshows all three act recipes in thecigrouplefthook run pre-commitrecognizes the actionlint hookjust act-testruns the test job locally (requiresact+ Docker)just act-lintruns the lint job locallyjust act-publishvalidates rockspec generation locally