mirror of
https://github.com/ivuorinen/actions.git
synced 2026-01-26 03:23:59 +00:00
Ismo Vuorinen
9aa16a8164
* feat: use our own actions in our workflows * fix: add missing inputs to validate-inputs, refactor node * chore: cr comment fixes * fix: update-validators formatting * chore: update validators, add tests, conventions * feat: validate severity with severity_enum * feat: add 10 generic validators to improve input validation coverage Add comprehensive validation system improvements across multiple phases: Phase 2A - Quick Wins: - Add multi_value_enum validator for 2-10 value enumerations - Add exit_code_list validator for Unix/Linux exit codes (0-255) - Refactor coverage_driver to use multi_value_enum Phase 2B - High-Value Validators: - Add key_value_list validator with shell injection prevention - Add path_list validator with path traversal and glob support Quick Wins - Additional Enums: - Add network_mode validator for Docker network modes - Add language_enum validator for language detection - Add framework_mode validator for PHP framework modes - Update boolean pattern to include 'push' Phase 2C - Specialized Validators: - Add json_format validator for JSON syntax validation - Add cache_config validator for Docker BuildKit cache configs Improvements: - All validators include comprehensive security checks - Pattern-based validation with clear error messages - 23 new test methods with edge case coverage - Update special case mappings for 20+ inputs - Fix build-args mapping test expectation Coverage impact: 22 actions now at 100% validation (88% → 92%) Test suite: 762 → 785 tests (+23 tests, all passing) * chore: regenerate rules.yml with improved validator coverage Regenerate validation rules for all actions with new validators: - compress-images: 86% → 100% (+1 input: ignore-paths) - docker-build: 63% → 100% (+4 inputs: cache configs, platform-build-args) - docker-publish: 73% → 100% (+1 input: build-args) - language-version-detect: 67% → 100% (+1 input: language) - php-tests: 89% (fixed framework→framework_mode mapping) - prettier-lint: 86% → 100% (+2 inputs: file-pattern, plugins) - security-scan: 86% (maintained coverage) Overall: 23 of 25 actions now at 100% validation coverage (92%) * fix: address PR #377 review comments - Add | None type annotations to 6 optional parameters (PEP 604) - Standardize injection pattern: remove @# from comma_separated_list validator (@ and # are not shell injection vectors, allows npm scoped packages) - Remove dead code: unused value expression in key_value_list validator - Update tests to reflect injection pattern changes
116 lines
3.9 KiB
Markdown
116 lines
3.9 KiB
Markdown
# GitHub Actions Monorepo - Overview
|
|
|
|
## Repository Info
|
|
|
|
- **Path**: /Users/ivuorinen/Code/ivuorinen/actions
|
|
- **Branch**: main
|
|
- **External Usage**: `ivuorinen/actions/<action-name>@main`
|
|
- **Total Actions**: 44 self-contained actions
|
|
- **Dogfooding**: Workflows use local actions (pr-lint, codeql-analysis, security-scan)
|
|
|
|
## Structure
|
|
|
|
```text
|
|
/
|
|
├── <action-dirs>/ # 44 self-contained actions
|
|
│ ├── action.yml # Action definition
|
|
│ ├── README.md # Auto-generated
|
|
│ └── CustomValidator.py # Optional validator
|
|
├── validate-inputs/ # Centralized validation
|
|
│ ├── validators/ # 9 specialized modules
|
|
│ ├── scripts/ # Rule/test generators
|
|
│ └── tests/ # 769 pytest tests
|
|
├── _tests/ # ShellSpec framework
|
|
├── _tools/ # Development utilities
|
|
├── .github/workflows/ # CI/CD workflows
|
|
└── Makefile # Build automation
|
|
```
|
|
|
|
## Action Categories (44 total)
|
|
|
|
**Setup (7)**: node-setup, set-git-config, php-version-detect, python-version-detect, python-version-detect-v2, go-version-detect, dotnet-version-detect
|
|
|
|
**Linting (13)**: ansible-lint-fix, biome-check/fix, csharp-lint-check, eslint-check/fix, go-lint, pr-lint, pre-commit, prettier-check/fix, python-lint-fix, terraform-lint-fix
|
|
|
|
**Security (1)**: security-scan (actionlint, Gitleaks, Trivy scanning)
|
|
|
|
**Build (3)**: csharp-build, go-build, docker-build
|
|
|
|
**Publishing (5)**: npm-publish, docker-publish, docker-publish-gh, docker-publish-hub, csharp-publish
|
|
|
|
**Testing (3)**: php-tests, php-laravel-phpunit, php-composer
|
|
|
|
**Repository (9)**: github-release, release-monthly, sync-labels, stale, compress-images, common-cache, common-file-check, common-retry, codeql-analysis
|
|
|
|
**Utilities (3)**: version-file-parser, version-validator, validate-inputs
|
|
|
|
## Key Principles
|
|
|
|
### Self-Contained Design
|
|
|
|
- No dependencies between actions
|
|
- Externally usable via GitHub Actions marketplace
|
|
- Custom validators colocated with actions
|
|
|
|
### Quality Standards
|
|
|
|
- **Zero Tolerance**: No failing tests, no linting issues
|
|
- **Production Ready**: Only when ALL checks pass
|
|
- **EditorConfig**: 2-space indent, LF, UTF-8, max 200 chars (120 for MD)
|
|
|
|
### Security Model
|
|
|
|
- SHA-pinned external actions (55 SHA-pinned, 0 unpinned)
|
|
- Token validation, injection detection
|
|
- Path traversal protection
|
|
- `set -euo pipefail` in all shell scripts
|
|
|
|
## Development Workflow
|
|
|
|
```bash
|
|
make all # Full pipeline: docs, format, lint, test
|
|
make dev # Format + lint
|
|
make lint # All linters (markdownlint, yaml-lint, shellcheck, ruff)
|
|
make test # All tests (pytest + ShellSpec)
|
|
```
|
|
|
|
## Testing Framework
|
|
|
|
- **ShellSpec**: GitHub Actions and shell scripts
|
|
- **pytest**: Python validators (769 tests, 100% pass rate)
|
|
- **Test Generator**: Automatic scaffolding for new actions
|
|
|
|
## Current Status
|
|
|
|
- ✅ All tests passing (769/769)
|
|
- ✅ Zero linting issues
|
|
- ✅ Modular validator architecture
|
|
- ✅ Convention-based validation
|
|
- ✅ Test generation system
|
|
- ✅ Full backward compatibility
|
|
|
|
## Dogfooding Strategy
|
|
|
|
The repository actively dogfoods its own actions in workflows:
|
|
|
|
**Fully Dogfooded Workflows**:
|
|
|
|
- **pr-lint.yml**: Uses `./pr-lint` (was 204 lines, now 112 lines - 45% reduction)
|
|
- **action-security.yml**: Uses `./security-scan` (was 264 lines, now 82 lines - 69% reduction)
|
|
- **codeql-new.yml**: Uses `./codeql-analysis`
|
|
- **sync-labels.yml**: Uses `./sync-labels`
|
|
- **version-maintenance.yml**: Uses `./action-versioning`
|
|
|
|
**Intentionally External**:
|
|
|
|
- **build-testing-image.yml**: Uses docker/\* actions directly (needs metadata extraction)
|
|
- Core GitHub actions (checkout, upload-artifact, setup-\*) kept for standardization
|
|
|
|
**Benefits**:
|
|
|
|
- Early detection of action issues
|
|
- Real-world testing of actions
|
|
- Reduced workflow duplication
|
|
- Improved maintainability
|
|
- Better documentation through usage examples
|