Skip to content

Commit 1a55da8

Browse files
author
Ian Lewis
authored
Fix linter pre-submit (slsa-framework#333)
* Update perms to make reviewdog work * Add test files * Fix sha for shfmt action * Rename linter pre-submit file * run golangci-lint manually * Fix workflows * Reduce permissions * fix lint workflow * fix lint workflow * use sha for setup-go * Add shellcheck job * run yamllint manually * add runs-on * fix untarring githubci-lint * fix untarring githubci-lint * output github actions commands * remove uncessary code * Remove test files * code cleanup * Add golangci-lint checksum check * Actually untar golangci-lint * add debug * Restore correct hash * Checksum the right file * fix dir * Remove unused ldflags * Disable linters generating issues for now * Disable stylecheck for now * Fix trailing spaces * Exit with positive error codes * Update references to reusable actions. * Add Makefile to make running linters easier * remove trailing whitespace * Fix formatting options for yamllint * Fix yamllint issues * Fix tag comments * Add docs on local development. * Update comment * Linters ignore vendor directory * Fix whitespace
1 parent e49ee2a commit 1a55da8

File tree

16 files changed

+264
-64
lines changed

16 files changed

+264
-64
lines changed

.github/actions/compute-sha256/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,5 +27,5 @@ runs:
2727
fi
2828
digest=$(sha256sum "$UNTRUSTED_PATH" | awk '{print $1}')
2929
echo "computed sha: $digest"
30-
30+
3131
echo "::set-output name=sha256::$digest"

.github/actions/generate-builder/action.yml

+6-6
Original file line numberDiff line numberDiff line change
@@ -44,15 +44,15 @@ runs:
4444
shell: bash
4545
env:
4646
# Builder.
47-
BUILDER_REPOSITORY: slsa-framework/slsa-github-generator # The repository to download the pre-built builder binary from.
48-
BUILDER_RELEASE_BINARY: "${{ inputs.binary }}" # The name of the pre-built binary in the release assets. This is also used as the final binary name when compiling the builder from source.
47+
BUILDER_REPOSITORY: slsa-framework/slsa-github-generator # The repository to download the pre-built builder binary from.
48+
BUILDER_RELEASE_BINARY: "${{ inputs.binary }}" # The name of the pre-built binary in the release assets. This is also used as the final binary name when compiling the builder from source.
4949
# Verifier
5050
# NOTE: These VERIFIER_* variables are used in the builder-fetch.sh script for verification of builder
5151
# release binaries when the compile-builder input is false.
52-
VERIFIER_REPOSITORY: slsa-framework/slsa-verifier # The repository to download the pre-built verifier binary from.
53-
VERIFIER_RELEASE_BINARY: slsa-verifier-linux-amd64 # The name of the verifier binary in the release assets.
54-
VERIFIER_RELEASE_BINARY_SHA256: f92fc4e571949c796d7709bb3f0814a733124b0155e484fad095b5ca68b4cb21 # The expected hash of the verifier binary.
55-
VERIFIER_RELEASE: v1.1.1 # The version of the verifier to download.
52+
VERIFIER_REPOSITORY: slsa-framework/slsa-verifier # The repository to download the pre-built verifier binary from.
53+
VERIFIER_RELEASE_BINARY: slsa-verifier-linux-amd64 # The name of the verifier binary in the release assets.
54+
VERIFIER_RELEASE_BINARY_SHA256: f92fc4e571949c796d7709bb3f0814a733124b0155e484fad095b5ca68b4cb21 # The expected hash of the verifier binary.
55+
VERIFIER_RELEASE: v1.1.1 # The version of the verifier to download.
5656

5757
COMPILE_BUILDER: "${{ inputs.compile-builder }}"
5858
BUILDER_REF: "${{ inputs.ref }}"

.github/actions/rng/action.yml

-1
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,3 @@ runs:
2929
# -c: the number of bytes displayed per column
3030
value=$(xxd -p -l "$LENGTH" -c "$LENGTH" /dev/urandom)
3131
echo "::set-output name=result::$value"
32-

.github/actions/secure-download-artifact/action.yml

+1-4
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ runs:
2222
env:
2323
UNTRUSTED_PATH: "${{ inputs.path }}"
2424
run: |
25-
2625
set -euo pipefail
2726
2827
if [ -e "$UNTRUSTED_PATH" ]; then
@@ -49,14 +48,13 @@ runs:
4948
SET_EXECUTABLE: "${{ inputs.set-executable }}"
5049
shell: bash
5150
run: |
52-
5351
set -euo pipefail
5452
5553
if ! [[ -f "$UNTRUSTED_PATH" ]]; then
5654
echo "File $UNTRUSTED_PATH not present"
5755
exit 5
5856
fi
59-
57+
6058
echo "expected hash is $UNTRUSTED_EXPECTED_HASH"
6159
echo "computed hash is $UNTRUSTED_COMPUTED_HASH"
6260
if [[ "$UNTRUSTED_COMPUTED_HASH" != "$UNTRUSTED_EXPECTED_HASH" ]]; then
@@ -68,4 +66,3 @@ runs:
6866
echo "Setting $UNTRUSTED_PATH as executable"
6967
chmod u+x "$UNTRUSTED_PATH"
7068
fi
71-

.github/workflows/builder_go_slsa3.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@ env:
2121
# Project.
2222
GENERATED_BINARY_NAME: go-compiled-binary
2323
# Builder.
24-
BUILDER_BINARY: slsa-builder-go-linux-amd64 # Name of the binary in the release assets.
25-
BUILDER_DIR: internal/builders/go # Source directory if we compile the builder.
24+
BUILDER_BINARY: slsa-builder-go-linux-amd64 # Name of the binary in the release assets.
25+
BUILDER_DIR: internal/builders/go # Source directory if we compile the builder.
2626

2727
###################################################################
2828
# #

.github/workflows/generator_generic_slsa3.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ permissions:
1919

2020
env:
2121
# Generator
22-
BUILDER_BINARY: slsa-generator-generic-linux-amd64 # Name of the binary in the release assets.
23-
BUILDER_DIR: internal/builders/generic # Source directory if we compile the builder.
22+
BUILDER_BINARY: slsa-generator-generic-linux-amd64 # Name of the binary in the release assets.
23+
BUILDER_DIR: internal/builders/generic # Source directory if we compile the builder.
2424

2525
on:
2626
workflow_call:
@@ -36,7 +36,7 @@ on:
3636
default: false
3737
attestation-name:
3838
description: >
39-
The artifact name of the signed provenance.
39+
The artifact name of the signed provenance.
4040
The file must have the intoto.jsonl extension.
4141
4242
Default: attestation.intoto.jsonl

.github/workflows/pre-submit.lint.yml

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Lint
2+
3+
on: [pull_request]
4+
5+
permissions:
6+
# Needed to check out the repo.
7+
contents: read
8+
9+
jobs:
10+
golangci-lint:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
14+
- uses: actions/setup-go@b22fbbc2921299758641fab08929b4ac52b32923 # tag=v3.2.0
15+
with:
16+
go-version: "1.18"
17+
- env:
18+
GOLANGCI_LINT_VERSION: "1.46.2"
19+
GOLANGCI_LINT_CHECKSUM: "242cd4f2d6ac0556e315192e8555784d13da5d1874e51304711570769c4f2b9b"
20+
run: |
21+
set -euo pipefail
22+
23+
#Install golangci-lint
24+
curl -sSLo golangci-lint.tar.gz "https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_LINT_VERSION}/golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64.tar.gz"
25+
echo "golangci-lint checksum is $(sha256sum golangci-lint.tar.gz | awk '{ print $1 }')"
26+
echo "expected checksum is $GOLANGCI_LINT_CHECKSUM"
27+
echo "$GOLANGCI_LINT_CHECKSUM golangci-lint.tar.gz" | sha256sum --strict --check --status || exit -2
28+
tar xf golangci-lint.tar.gz
29+
mv golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64/golangci-lint /usr/local/bin
30+
31+
# Run golangci-lint
32+
make golangci-lint
33+
34+
shellcheck:
35+
runs-on: ubuntu-latest
36+
steps:
37+
- uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
38+
- env:
39+
SHELLCHECK_VERSION: "0.8.0"
40+
run: |
41+
set -euo pipefail
42+
43+
# Install shellcheck
44+
wget -qO- "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" | tar -xJf -
45+
mv "shellcheck-v$SHELLCHECK_VERSION/shellcheck" /usr/local/bin
46+
47+
# Run shellcheck and output github actions commands.
48+
# See: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions
49+
make shellcheck
50+
51+
yamllint:
52+
runs-on: ubuntu-latest
53+
steps:
54+
- uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
55+
- env:
56+
YAMLLINT_VERSION: "1.26.3"
57+
run: |
58+
set -euo pipefail
59+
60+
# Install yamllint
61+
pip install "yamllint==${YAMLLINT_VERSION}"
62+
63+
# Run yamllint
64+
make yamllint

.github/workflows/release.yml

-1
Original file line numberDiff line numberDiff line change
@@ -35,4 +35,3 @@ jobs:
3535
go-version: 1.18
3636
config-file: .github/workflows/configs-go/config-release.yml
3737
compile-builder: true
38-

.golangci.yml

+36-21
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@ run:
33
concurrency: 2
44
deadline: 5m
55
issues:
6-
include:
7-
# revive `package-comments` and `exported` rules.
8-
- EXC0012
9-
- EXC0013
10-
- EXC0014
11-
- EXC0015
6+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): revive `package-comments` and `exported` rules.
7+
# include:
8+
# - EXC0012
9+
# - EXC0013
10+
# - EXC0014
11+
# - EXC0015
1212
# Maximum issues count per one linter.
1313
# Set to 0 to disable.
1414
# Default: 50
@@ -27,47 +27,62 @@ linters:
2727
- deadcode
2828
- depguard
2929
- dogsled
30-
- errcheck
31-
- errorlint
30+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable errcheck
31+
# - errcheck
32+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable errorlint
33+
# - errorlint
3234
- exhaustive
33-
- exportloopref
34-
- gci
35+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable exportloopref
36+
# - exportloopref
37+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable gci
38+
# - gci
3539
- gochecknoinits
3640
- gocognit
3741
- goconst
38-
- gocritic
42+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable gocritic
43+
# - gocritic
3944
- gocyclo
4045
- godot
41-
- godox
42-
- goerr113
46+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable godox
47+
# - godox
48+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable goerr113
49+
# - goerr113
4350
- gofmt
4451
- gofumpt
4552
- goheader
4653
- goimports
4754
- gomodguard
4855
- goprintffuncname
49-
- gosec
56+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable gosec
57+
# - gosec
5058
- gosimple
51-
- govet
59+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable govet
60+
# - govet
5261
- ineffassign
53-
- lll
62+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable lll
63+
# - lll
5464
- makezero
5565
- misspell
5666
- nakedret
57-
- nestif
67+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable nestif
68+
# - nestif
5869
- nolintlint
59-
- paralleltest
70+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable paralleltest
71+
# - paralleltest
6072
- predeclared
6173
- revive
6274
- staticcheck
63-
- stylecheck
64-
- thelper
75+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable stylecheck
76+
# - stylecheck
77+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable thelper
78+
# - thelper
6579
- typecheck
6680
- unconvert
6781
- unused
6882
- varcheck
6983
- whitespace
70-
- wrapcheck
84+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/450): enable thelper
85+
# - wrapcheck
7186
linters-settings:
7287
errcheck:
7388
check-type-assertions: true

.yamllint.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
---
22
extends: default
33

4+
ignore: |
5+
node_modules/
6+
vendor/
7+
48
rules:
59
comments:
610
# prettier formats comments one space from content

Makefile

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
SHELL := /bin/bash
2+
OUTPUT_FORMAT = $(shell if [ "${GITHUB_ACTIONS}" == "true" ]; then echo "github"; else echo ""; fi)
3+
4+
.PHONY: help
5+
help: ## Shows all targets and help from the Makefile (this message).
6+
@echo "slsa-github-generator Makefile"
7+
@echo "Usage: make [COMMAND]"
8+
@echo ""
9+
@grep --no-filename -E '^([/a-z.A-Z0-9_%-]+:.*?|)##' $(MAKEFILE_LIST) | \
10+
awk 'BEGIN {FS = "(:.*?|)## ?"}; { \
11+
if (length($$1) > 0) { \
12+
printf " \033[36m%-20s\033[0m %s\n", $$1, $$2; \
13+
} else { \
14+
if (length($$2) > 0) { \
15+
printf "%s\n", $$2; \
16+
} \
17+
} \
18+
}'
19+
20+
## Testing
21+
#####################################################################
22+
23+
unit-test: ## Runs all unit tests.
24+
# Run unit tests for the detect-workflow action.
25+
cd .github/actions/detect-workflow
26+
go mod vendor
27+
go test -mod=vendor -v ./...
28+
# Run unit tests for the main package.
29+
cd -
30+
go mod vendor
31+
go test -mod=vendor -v ./...
32+
33+
34+
## Linters
35+
#####################################################################
36+
37+
lint: ## Run all linters.
38+
lint: golangci-lint shellcheck yamllint
39+
40+
golangci-lint: ## Runs the golangci-lint linter.
41+
@set -e;\
42+
extraargs=""; \
43+
if [ "$(OUTPUT_FORMAT)" == "github" ]; then \
44+
extraargs="--out-format github-actions"; \
45+
fi; \
46+
golangci-lint run -c .golangci.yml ./... $$extraargs
47+
48+
shellcheck: ## Runs the shellcheck linter.
49+
@set -e;\
50+
FILES=$$(find . -type f -not -iwholename '*/.git/*' -not -iwholename '*/vendor/*' -not -iwholename '*/node_modules/*' -exec bash -c 'file "$$1" | cut -d':' -f2 | grep --quiet shell' _ {} \; -print); \
51+
if [ "$(OUTPUT_FORMAT)" == "github" ]; then \
52+
echo -n $$FILES | xargs shellcheck -f json --external-sources | jq -c '.[]' | while IFS="" read -r p || [ -n "$$p" ]; do \
53+
LEVEL=$$(echo "$$p" | jq -c '.level // empty' | tr -d '"'); \
54+
FILE=$$(echo "$$p" | jq -c '.file // empty' | tr -d '"'); \
55+
LINE=$$(echo "$$p" | jq -c '.line // empty' | tr -d '"'); \
56+
ENDLINE=$$(echo "$$p" | jq -c '.endLine // empty' | tr -d '"'); \
57+
COL=$$(echo "$$p" | jq -c '.column // empty' | tr -d '"'); \
58+
ENDCOL=$$(echo "$$p" | jq -c '.endColumn // empty' | tr -d '"'); \
59+
MESSAGE=$$(echo "$$p" | jq -c '.message // empty' | tr -d '"'); \
60+
case $$LEVEL in \
61+
"info") \
62+
echo "::notice file=$${FILE},line=$${LINE},endLine=$${ENDLINE},col=$${COL},endColumn=$${ENDCOL}::$${MESSAGE}"; \
63+
;; \
64+
"warning") \
65+
echo "::warning file=$${FILE},line=$${LINE},endLine=$${ENDLINE},col=$${COL},endColumn=$${ENDCOL}::$${MESSAGE}"; \
66+
;; \
67+
"error") \
68+
echo "::error file=$${FILE},line=$${LINE},endLine=$${ENDLINE},col=$${COL},endColumn=$${ENDCOL}::$${MESSAGE}"; \
69+
;; \
70+
esac; \
71+
done; \
72+
else \
73+
echo -n $$FILES | xargs shellcheck --external-sources; \
74+
fi
75+
76+
yamllint: ## Runs the yamllint linter.
77+
@set -e;\
78+
extraargs=""; \
79+
if [ "$(OUTPUT_FORMAT)" == "github" ]; then \
80+
extraargs="-f github"; \
81+
fi; \
82+
yamllint -c .yamllint.yaml . $$extraargs

0 commit comments

Comments
 (0)