name: Static Analysis

on:

pull_request:

types: [opened, edited]

jobs:

pr-lint:

if: github.event_name == 'pull_request'

runs-on: ubuntu-24.04

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

permissions:

pull-requests: read

steps:

- name: Enforce PR title length <= 64

# Don't run for Dependabot PRs

if: ${{ !contains(github.event.pull_request.head.label, 'dependabot') }}

env:

PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}

REPOSITORY_NAME: ${{ github.repository }}

run: |

PR_TITLE=$(gh pr view "$PULL_REQUEST_NUMBER" --repo "$REPOSITORY_NAME" --json title -q '.title')

pr_title_length=${#PR_TITLE}

# 64 instead of 72 because GitHub adds the PR number to the title

if [ "$pr_title_length" -gt 64 ]; then

echo "PR title too long. Please keep it under 64 characters."

exit 1

fi

- uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 #v6.1.1

version-check:

runs-on: ubuntu-24.04

steps:

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Check version is up to date

run: |

./scripts/bump-versions.sh

if [ -z "$(git status --porcelain)" ]; then

# Working directory clean

echo "Version manifests up to date"

else

# Uncommitted changes

echo "'scripts/bump-versions.sh' found outdated files! Showing diff"

git diff

exit 1

fi

link-check:

runs-on: ubuntu-24.04

steps:

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0

with:

fail: true

args: --offline --verbose --no-progress **/*.md

global-linter:

runs-on: ubuntu-24.04

env:

MISE_EXPERIMENTAL: 1

permissions:

security-events: write

steps:

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- uses: ./.github/actions/setup-mise

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5

name: Restore pip cache

id: pip-cache

with:

path: ~/.cache/pip

key: ubuntu-24.04-${{ runner.arch }}-pip-${{ hashFiles('.github/requirements.txt') }}

- uses: ./.github/actions/setup-node

with:

npmjs-token: ${{ secrets.NPMJS_TOKEN }}

lockfile-dir: ./.github

- name: Install lint tools

run: mise run lint-setup

- name: Run linters

run: mise run lint

- uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5

if: ${{ steps.pip-cache.outputs.cache-hit != 'true' }}

name: Save pip cache

with:

path: ~/.cache/pip

key: ${{ steps.pip-cache.outputs.cache-primary-key }}