mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-04 02:57:27 +09:00
Aleksei Sviridkin
8aa30472b6
The comment above the top-level `permissions` block claimed that jobs request the minimum extra scopes on top of it. A job-level block does not add to the workflow-level one: it replaces it, and every scope the job does not name is set to none. A job needing one extra scope has to restate `contents: read` alongside it or lose read access to the repository. The corrected wording states the replace semantics, so the next job block written against this comment grants the whole set it needs rather than only the delta. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
75 lines
2.4 KiB
YAML
75 lines
2.4 KiB
YAML
name: Pre-Commit Checks
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
|
|
concurrency:
|
|
group: pre-commit-${{ github.workflow }}-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
# Top-level token defaults to read-only. A job-level block replaces this one
|
|
# rather than adding to it, so each job restates every scope it needs.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
pre-commit:
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
|
|
with:
|
|
fetch-depth: 0
|
|
fetch-tags: true
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
|
|
with:
|
|
python-version: '3.11'
|
|
|
|
- name: Install pre-commit
|
|
run: pip install pre-commit
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: Pre-fetch k8s.io/code-generator module
|
|
# The repo-root pre-commit hook (run-make-generate-root) shells out to
|
|
# hack/update-codegen.sh, which sources kube_codegen.sh from the Go
|
|
# module cache. The module is not declared in go.mod, so fetch it
|
|
# explicitly at the version pinned in the script - mirrors the
|
|
# equivalent step in codegen-drift.yml.
|
|
run: |
|
|
version=$(grep -oP 'code-generator@\Kv[0-9.]+' hack/update-codegen.sh)
|
|
tmpdir=$(mktemp -d)
|
|
cd "$tmpdir"
|
|
go mod init codegen-fetch
|
|
go get "k8s.io/code-generator@${version}"
|
|
|
|
- name: Install generate
|
|
run: |
|
|
curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.6.0/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
|
|
|
|
- name: Run pre-commit hooks
|
|
run: |
|
|
git fetch origin main || git fetch origin master
|
|
base_commit=$(git rev-parse --verify origin/main || git rev-parse --verify origin/master || echo "")
|
|
|
|
if [ -z "$base_commit" ]; then
|
|
files=$(git ls-files '*.yaml' '*.md')
|
|
else
|
|
files=$(git diff --name-only "$base_commit" -- '*.yaml' '*.md')
|
|
fi
|
|
|
|
if [ -n "$files" ]; then
|
|
echo "$files" | xargs pre-commit run --files
|
|
else
|
|
echo "No YAML or Markdown files to lint"
|
|
fi
|