name: Style

on:

push:

tags:

- '*'

branches:

- master

- release-*

pull_request:

types:

- opened

- reopened

- synchronize

env:

ROX_PRODUCT_BRANDING: RHACS_BRANDING

concurrency:

group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}

cancel-in-progress: true

jobs:

check-generated-files:

env:

ARTIFACT_DIR: junit-reports/

runs-on: ubuntu-latest

steps:

- name: Checkout

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6

with:

fetch-depth: 0

ref: ${{ github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # ratchet:actions/setup-go@v6

with:

go-version-file: go.mod

cache: false

# setup-go@v6 exports GOTOOLCHAIN=local; override so sub-module tools

# with newer go directives (e.g. tools/proto) can auto-download.

- name: Override GOTOOLCHAIN

run: echo "GOTOOLCHAIN=auto" >> "$GITHUB_ENV"

- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # ratchet:actions/setup-python@v6

with:

python-version-file: operator/bundle_helpers/.python-version

- name: Create artifacts dir

run: mkdir -p "$ARTIFACT_DIR"

- name: Cache Go dependencies

uses: ./.github/actions/cache-go-dependencies

- name: Download scanner module for proto generation

run: go mod download github.com/stackrox/scanner

- name: Check Generated

run: scripts/ci/jobs/check-generated.sh

misc-checks:

env:

ARTIFACT_DIR: junit-reports/

runs-on: ubuntu-latest

steps:

- name: Checkout

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6

with:

fetch-depth: 0

ref: ${{ github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # ratchet:actions/setup-go@v6

with:

go-version-file: go.mod

cache: false

# setup-go@v6 exports GOTOOLCHAIN=local; override so sub-module tools

# with newer go directives (e.g. tools/proto) can auto-download.

- name: Override GOTOOLCHAIN

run: echo "GOTOOLCHAIN=auto" >> "$GITHUB_ENV"

- name: Create artifacts dir

run: mkdir -p "$ARTIFACT_DIR"

- name: Ensure no trailing whitespaces

if: github.event_name == 'pull_request'

# Markdown files aren't checked for trailing whitespaces because it's a valid linebreak there.

run: git diff --check "${{ github.event.pull_request.base.sha }}"...HEAD ':(exclude)*.md'

- name: Check PR fixes

run: scripts/ci/jobs/check-pr-fixes.sh

- name: Check TODOs

run: scripts/ci/jobs/check-todos.sh

- name: Check Policies

run: scripts/ci/jobs/policy-checks.sh

- name: Check Konflux setup

run: scripts/ci/jobs/check-konflux-setup.sh

- name: Check build & test image versions

run: scripts/ci/jobs/check-image-version.sh

- name: Check dependabot knows about pinned prefetched images

run: scripts/ci/jobs/check-dependabot-pinned-image.sh

- name: Check dependabot gomod configurations match go.mod files

run: if [ -s scripts/ci/jobs/check-dependabot-gomod.sh ]; then scripts/ci/jobs/check-dependabot-gomod.sh; fi

style-check:

runs-on: ubuntu-latest

steps:

- name: Checkout

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6

with:

fetch-depth: 0

ref: ${{ github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

free-disk-space: '30'

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # ratchet:actions/setup-go@v6

with:

go-version-file: go.mod

cache: false

# setup-go@v6 exports GOTOOLCHAIN=local; override so sub-module tools

# with newer go directives (e.g. tools/proto) can auto-download.

- name: Override GOTOOLCHAIN

run: echo "GOTOOLCHAIN=auto" >> "$GITHUB_ENV"

- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # ratchet:actions/setup-node@v6

with:

node-version-file: ui/package.json

- name: Install xmlstarlet for shellcheck output to junit

run: |

sudo apt-get update -qq && sudo apt-get install -y -qq xmlstarlet

- name: Install pycodestyle

run: |

python3 -m pip install -r .openshift-ci/dev-requirements.txt

- name: Verify tools

run: |

yq --version

xmlstarlet --version

pycodestyle --version

- name: Cache Go dependencies

uses: ./.github/actions/cache-go-dependencies

- name: Download scanner module for proto generation

run: go mod download github.com/stackrox/scanner

- name: Cache UI dependencies

uses: ./.github/actions/cache-ui-dependencies

- name: Cache QA Test dependencies

uses: ./.github/actions/cache-gradle-dependencies

- name: Fetch UI deps

run: make -C ui deps

- name: Cache ESLint results

uses: ./.github/actions/cache-eslint

- name: make style-slim

run: make style-slim

golangci-lint:

timeout-minutes: 240

runs-on: ubuntu-latest

steps:

- name: Checkout

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # ratchet:actions/setup-go@v6

with:

go-version-file: 'tools/linters/go.mod'

cache: false # ~3,354 MB via setup-go; disabled to stay within 10 GB budget

- name: Check Cache golangci-lint

run: make golangci-lint-cache-status

- name: Cache golangci-lint

if: github.event_name == 'push' && github.ref_name == github.event.repository.default_branch

uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # ratchet:actions/cache@v5

with:

path: ${{ env.HOME }}/.cache/golangci-lint

key: go-lint-v2-${{ hashFiles('**/go.sum') }}

restore-keys: |

go-lint-v2-

- name: Restore golangci-lint analysis cache

if: ${{ !(github.event_name == 'push' && github.ref_name == github.event.repository.default_branch) }}

uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # ratchet:actions/cache/restore@v5

with:

path: ${{ env.HOME }}/.cache/golangci-lint

key: go-lint-v2-${{ hashFiles('**/go.sum') }}

restore-keys: |

go-lint-v2-

- name: Check cache golangci-lint

run: make golangci-lint-cache-status

- name: Check Go version is in sync in .golangci.yml and go.mod

run: |

[ "$(awk '/^go /{print $2}' go.mod | cut -d. -f 1-2)" = "$(yq e .run.go .golangci.yml)" ]

- name: make golangci-lint

run: make golangci-lint

- name: Check Cache golangci-lint

run: make golangci-lint-cache-status

check-dependent-images-exist:

# This job ensures that COLLECTOR_VERSION, FACT_VERSION or SCANNER_VERSION files cannot be updated to a version

# for which the image was not successfully built on Konflux (suffix "-fast"). It also verifies that GHA-built image

# is there (no suffix) so that the failure also happens in this job.

runs-on: ubuntu-latest

steps:

- name: Checkout repo

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Get image tags from COLLECTOR|FACT|SCANNER_VERSION file

run: |

{

echo "collector_tag=$(make --quiet --no-print-directory collector-tag)"

echo "fact_tag=$(make --quiet --no-print-directory fact-tag)"

echo "scanner_tag=$(make --quiet --no-print-directory scanner-tag)"

} >> "$GITHUB_ENV"

- name: Check GHA-built image exists

uses: stackrox/actions/release/wait-for-image@9238e423c3ae1ac4eb0f254cbb98da9daae24d86 # ratchet:stackrox/actions/release/wait-for-image@v1

# Skip for external contributions.

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

with:

token: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }}

limit: 300

image: |

rhacs-eng/collector:${{ env.collector_tag }}

rhacs-eng/fact:${{ env.fact_tag }}

rhacs-eng/scanner:${{ env.scanner_tag }}

rhacs-eng/scanner-slim:${{ env.scanner_tag }}

rhacs-eng/scanner-db:${{ env.scanner_tag }}

rhacs-eng/scanner-db-slim:${{ env.scanner_tag }}

- name: Check Konflux-built image exists

uses: stackrox/actions/release/wait-for-image@9238e423c3ae1ac4eb0f254cbb98da9daae24d86 # ratchet:stackrox/actions/release/wait-for-image@v1

# Skip for external contributions.

if: |

github.event_name == 'push' || !github.event.pull_request.head.repo.fork

with:

token: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }}

limit: 300

image: |

rhacs-eng/release-collector:${{ env.collector_tag }}-fast

rhacs-eng/release-fact:${{ env.fact_tag }}-fast

rhacs-eng/release-scanner:${{ env.scanner_tag }}-fast

rhacs-eng/release-scanner-slim:${{ env.scanner_tag }}-fast

rhacs-eng/release-scanner-db:${{ env.scanner_tag }}-fast

rhacs-eng/release-scanner-db-slim:${{ env.scanner_tag }}-fast

github-actions-lint:

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Download actionlint

id: get_actionlint

run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/2ab3a12c7848f6c15faca9a92612ef4261d0e370/scripts/download-actionlint.bash) 1.6.27

shell: bash

- name: Check workflow files

run: ${{ steps.get_actionlint.outputs.executable }} -color

shell: bash

github-actions-shellcheck:

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Check scripts with shellcheck

run: shellcheck -P SCRIPTDIR -x ./.github/workflows/scripts/*.sh

openshift-ci-lint:

runs-on: ubuntu-latest

steps:

- name: Checkout

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6

with:

fetch-depth: 0

ref: ${{ github.event.pull_request.head.sha }}

- uses: ./.github/actions/job-preamble

with:

gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}

- name: Install Python linters

run: python3 -m pip install -r .openshift-ci/dev-requirements.txt

- name: pycodestyle

run: make -C .openshift-ci style

- name: Pylint

run: make -C .openshift-ci lint

slack-on-style-failure:

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

SLACK_CI_INTEGRATION_TESTING_WEBHOOK: ${{ secrets.SLACK_CI_INTEGRATION_TESTING_WEBHOOK }}

TEST_FAILURES_NOTIFY_WEBHOOK: ${{ secrets.TEST_FAILURES_NOTIFY_WEBHOOK }}

if: |

failure() && (

github.event_name == 'push' ||

contains(github.event.pull_request.labels.*.name, 'ci-test-github-action-slack-messages')

)

name: Post failure message to Slack

runs-on: ubuntu-latest

needs:

- check-generated-files

- misc-checks

- style-check

- golangci-lint

- check-dependent-images-exist

- github-actions-lint

- github-actions-shellcheck

- openshift-ci-lint

permissions:

actions: read

steps:

- name: Checkout

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6

- name: Slack message

env:

GITHUB_CONTEXT: ${{ toJSON(github) }}

run: |

source scripts/ci/lib.sh

slack_workflow_failure