actions/pr-lint/action.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-action.json
# permissions:
#   - contents: write  # Required for committing linter fixes
#   - pull-requests: write  # Required for creating pull requests with fixes
---
# MegaLinter GitHub Action configuration file
# More info at https://megalinter.io
name: PR Lint
description: Runs MegaLinter against pull requests
author: Ismo Vuorinen

branding:
  icon: check-circle
  color: green

inputs:
  token:
    description: 'GitHub token for authentication'
    required: false
    default: ''
  username:
    description: 'GitHub username for commits'
    required: false
    default: 'github-actions'
  email:
    description: 'GitHub email for commits'
    required: false
    default: 'github-actions@github.com'

outputs:
  validation_status:
    description: 'Overall validation status (success/failure)'
    value: ${{ steps.ml.outputs.has_updated_sources == '1' && 'failure' || 'success' }}
  errors_found:
    description: 'Number of linting errors found'
    value: ${{ steps.ml.outputs.has_updated_sources }}

runs:
  using: composite
  steps:
    - name: Validate Inputs
      id: validate
      uses: ivuorinen/actions/validate-inputs@0fa9a68f07a1260b321f814202658a6089a43d42
      with:
        action-type: pr-lint
        token: ${{ inputs.token }}
        username: ${{ inputs.username }}
        email: ${{ inputs.email }}

    #   ╭──────────────────────────────────────────────────────────╮
    #   │                       Git Checkout                       │
    #   ╰──────────────────────────────────────────────────────────╯
    - name: Checkout Code
      uses: actions/checkout@71cf2267d89c5cb81562390fa70a37fa40b1305e # v6-beta
      with:
        token: ${{ inputs.token || github.token }}
        ref: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref_name }}
        persist-credentials: false

        # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to
        # improve performance
        fetch-depth: 0

    #   ╭──────────────────────────────────────────────────────────╮
    #   │               Install packages for linting               │
    #   ╰──────────────────────────────────────────────────────────╯

    # Node.js tests if package.json exists
    - name: Detect package.json
      id: detect-node
      shell: sh
      run: |
        set -eu

        if [ -f package.json ]; then
          printf '%s\n' "found=true" >> "$GITHUB_OUTPUT"
        fi

    - name: Setup Node.js environment
      if: steps.detect-node.outputs.found == 'true'
      id: node-setup
      uses: ivuorinen/actions/node-setup@0fa9a68f07a1260b321f814202658a6089a43d42

    - name: Cache Node Dependencies
      if: steps.detect-node.outputs.found == 'true'
      id: node-cache
      uses: ivuorinen/actions/common-cache@0fa9a68f07a1260b321f814202658a6089a43d42
      with:
        type: 'npm'
        paths: 'node_modules'
        key-files: 'package-lock.json,yarn.lock,pnpm-lock.yaml,bun.lockb'
        key-prefix: 'pr-lint-${{ steps.node-setup.outputs.package-manager }}'

    - name: Install Node Dependencies
      if: steps.detect-node.outputs.found == 'true' && steps.node-cache.outputs.cache-hit != 'true'
      shell: sh
      env:
        PACKAGE_MANAGER: ${{ steps.node-setup.outputs.package-manager }}
      run: |
        set -eu

        echo "Installing dependencies using $PACKAGE_MANAGER..."

        case "$PACKAGE_MANAGER" in
          "pnpm")
            pnpm install --frozen-lockfile
            ;;
          "yarn")
            if [ -f ".yarnrc.yml" ]; then
              yarn install --immutable
            else
              yarn install --frozen-lockfile
            fi
            ;;
          "bun")
            bun install --frozen-lockfile
            ;;
          "npm"|*)
            npm ci
            ;;
        esac

        echo "✅ Dependencies installed successfully"

    # PHP tests if composer.json exists
    - name: Detect composer.json
      id: detect-php
      shell: sh
      run: |
        set -eu

        if [ -f composer.json ]; then
          printf '%s\n' "found=true" >> "$GITHUB_OUTPUT"
        fi

    - name: Detect PHP Version
      if: steps.detect-php.outputs.found == 'true'
      id: php-version
      uses: ivuorinen/actions/language-version-detect@0fa9a68f07a1260b321f814202658a6089a43d42
      with:
        language: 'php'

    - name: Setup PHP
      if: steps.detect-php.outputs.found == 'true'
      uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
      with:
        php-version: ${{ steps.php-version.outputs.detected-version }}
        tools: composer
        coverage: none
      env:
        GITHUB_TOKEN: ${{ inputs.token }}

    - name: Setup problem matchers for PHP
      if: steps.detect-php.outputs.found == 'true'
      shell: sh
      env:
        RUNNER_TOOL_CACHE: ${{ runner.tool_cache }}
      run: |
        set -eu

        echo "::add-matcher::$RUNNER_TOOL_CACHE/php.json"

    - name: Install PHP dependencies
      if: steps.detect-php.outputs.found == 'true'
      shell: sh
      run: |
        set -eu

        composer install --no-progress --prefer-dist --no-interaction

    # Python tests if requirements.txt exists
    - name: Detect requirements.txt
      id: detect-python
      shell: sh
      run: |
        set -eu

        if [ -f requirements.txt ]; then
          printf '%s\n' "found=true" >> "$GITHUB_OUTPUT"
        fi

    - name: Detect Python Version
      if: steps.detect-python.outputs.found == 'true'
      id: python-version
      uses: ivuorinen/actions/language-version-detect@0fa9a68f07a1260b321f814202658a6089a43d42
      with:
        language: 'python'

    - name: Setup Python
      if: steps.detect-python.outputs.found == 'true'
      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
      with:
        python-version: ${{ steps.python-version.outputs.detected-version }}
        cache: 'pip'

    - name: Install Python dependencies
      if: steps.detect-python.outputs.found == 'true'
      shell: sh
      run: |
        set -eu

        pip install -r requirements.txt

    # Go tests if go.mod exists
    - name: Detect go.mod
      id: detect-go
      shell: sh
      run: |
        set -eu

        if [ -f go.mod ]; then
          printf '%s\n' "found=true" >> "$GITHUB_OUTPUT"
        fi

    - name: Detect Go Version
      if: steps.detect-go.outputs.found == 'true'
      id: go-version
      uses: ivuorinen/actions/language-version-detect@0fa9a68f07a1260b321f814202658a6089a43d42
      with:
        language: 'go'

    - name: Setup Go
      if: steps.detect-go.outputs.found == 'true'
      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
      with:
        go-version: ${{ steps.go-version.outputs.detected-version }}
        cache: true

    #   ╭──────────────────────────────────────────────────────────╮
    #   │                        MegaLinter                        │
    #   ╰──────────────────────────────────────────────────────────╯
    - name: MegaLinter
      # You can override MegaLinter flavor used to have faster performances
      # More info at https://megalinter.io/latest/flavors/
      uses: oxsecurity/megalinter/flavors/cupcake@62c799d895af9bcbca5eacfebca29d527f125a57 # v9.1.0
      id: ml

      # All available variables are described in documentation
      # https://megalinter.io/latest/configuration/
      env:
        # Validates all source when push on main, else just the git diff with
        # main. Override with true if you always want to lint all sources
        #
        # To validate the entire codebase, set to:
        # VALIDATE_ALL_CODEBASE: true
        #
        # To validate only diff with main, set to:
        # VALIDATE_ALL_CODEBASE: >-
        #   ${{
        #     github.event_name == 'push' &&
        #     contains(fromJSON('["refs/heads/main", "refs/heads/master"]'), github.ref)
        #   }}
        VALIDATE_ALL_CODEBASE: >-
          ${{
            github.event_name == 'push' &&
            contains(fromJSON('["refs/heads/main", "refs/heads/master"]'), github.ref)
          }}

        GITHUB_TOKEN: ${{ inputs.token || github.token }}

        # Apply linter fixes configuration
        #
        # When active, APPLY_FIXES must also be defined as environment variable
        # (in .github/workflows/mega-linter.yml or other CI tool)
        APPLY_FIXES: all

        # Decide which event triggers application of fixes in a commit or a PR
        # (pull_request, push, all)
        APPLY_FIXES_EVENT: pull_request

        # If APPLY_FIXES is used, defines if the fixes are directly committed (commit)
        # or posted in a PR (pull_request)
        APPLY_FIXES_MODE: commit

        # ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE
        # .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY

        # Uncomment to disable copy-paste and spell checks
        DISABLE: COPYPASTE,SPELL

    # Export env vars to make them available for subsequent expressions
    - name: Export Apply Fixes Variables
      shell: sh
      run: |
        echo "APPLY_FIXES_EVENT=pull_request" >> "$GITHUB_ENV"
        echo "APPLY_FIXES_MODE=commit" >> "$GITHUB_ENV"

    # Upload MegaLinter artifacts
    - name: Archive production artifacts
      if: success() || failure()
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        name: MegaLinter reports
        include-hidden-files: 'true'
        path: |
          megalinter-reports
          mega-linter.log

    # Set APPLY_FIXES_IF var for use in future steps
    - name: Set APPLY_FIXES_IF var
      shell: sh
      env:
        APPLY_FIXES_CONDITION: >-
          ${{
            steps.ml.outputs.has_updated_sources == 1 &&
            (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) &&
            (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository)
          }}
      run: |
        set -eu

        # Sanitize by removing newlines to prevent env var injection
        sanitized_condition="$(echo "$APPLY_FIXES_CONDITION" | tr -d '\n\r')"
        printf 'APPLY_FIXES_IF=%s\n' "$sanitized_condition" >> "${GITHUB_ENV}"

    # Set APPLY_FIXES_IF_* vars for use in future steps
    - name: Set APPLY_FIXES_IF_* vars
      shell: sh
      env:
        APPLY_FIXES_IF_PR_CONDITION: ${{ env.APPLY_FIXES_IF == 'true' && env.APPLY_FIXES_MODE == 'pull_request' }}
        APPLY_FIXES_IF_COMMIT_CONDITION: ${{ env.APPLY_FIXES_IF == 'true' && env.APPLY_FIXES_MODE == 'commit' && (!contains(fromJSON('["refs/heads/main", "refs/heads/master"]'), github.ref)) }}
      run: |
        set -eu

        # Sanitize by removing newlines to prevent env var injection
        sanitized_pr="$(echo "$APPLY_FIXES_IF_PR_CONDITION" | tr -d '\n\r')"
        sanitized_commit="$(echo "$APPLY_FIXES_IF_COMMIT_CONDITION" | tr -d '\n\r')"

        printf 'APPLY_FIXES_IF_PR=%s\n' "$sanitized_pr" >> "${GITHUB_ENV}"
        printf 'APPLY_FIXES_IF_COMMIT=%s\n' "$sanitized_commit" >> "${GITHUB_ENV}"

    # Create pull request if applicable
    # (for now works only on PR from same repository, not from forks)
    - name: Create Pull Request with applied fixes
      uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
      id: cpr
      if: env.APPLY_FIXES_IF_PR == 'true'
      with:
        token: ${{ inputs.token || github.token }}
        commit-message: 'style: apply linter fixes'
        title: 'style: apply linter fixes'
        labels: bot

    - name: Create PR output
      if: env.APPLY_FIXES_IF_PR == 'true'
      shell: sh
      env:
        PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
        PR_URL: ${{ steps.cpr.outputs.pull-request-url }}
      run: |
        set -eu

        echo "PR Number - $PR_NUMBER"
        echo "PR URL - $PR_URL"

    # Push new commit if applicable
    # (for now works only on PR from same repository, not from forks)
    - name: Prepare commit
      if: env.APPLY_FIXES_IF_COMMIT == 'true'
      shell: sh
      env:
        BRANCH_REF: >-
          ${{
            github.event.pull_request.head.ref ||
            github.head_ref ||
            github.ref_name
          }}
      run: |
        set -eu

        # Fix .git directory ownership after MegaLinter container execution
        sudo chown -Rc "$UID" .git/

        # Ensure we're on the correct branch (not in detached HEAD state)
        # This is necessary because MegaLinter may leave the repo in a detached HEAD state
        current_branch=$(git rev-parse --abbrev-ref HEAD)
        if [ "$current_branch" = "HEAD" ]; then
          echo "Repository is in detached HEAD state, checking out $BRANCH_REF"
          # Validate branch reference to prevent command injection
          if ! git check-ref-format --branch "$BRANCH_REF"; then
            echo "::error::Invalid branch reference format: $BRANCH_REF"
            exit 1
          fi
          git checkout "$BRANCH_REF"
        else
          echo "Repository is on branch: $current_branch"
        fi

    - name: Commit and push applied linter fixes
      uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3 # v7.0.0
      if: env.APPLY_FIXES_IF_COMMIT == 'true'
      with:
        branch: >-
          ${{
            github.event.pull_request.head.ref ||
            github.head_ref ||
            github.ref
          }}
        commit_message: 'style: apply linter fixes'
        commit_user_name: ${{ inputs.username }}
        commit_user_email: ${{ inputs.email }}