security-1/.github/workflows/code-hygiene.yml at main · devardee/security-1 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
name: Code Hygiene

on: [push, pull_request]

jobs:
  linelint:
    runs-on: ubuntu-latest
    name: Check if all files end in newline
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6

      - name: Linelint
        uses: fernandrone/linelint@7907a5dca0c28ea7dd05c6d8d8cacded713aca11 # 0.0.6

  spotless:
    runs-on: ubuntu-latest
    name: Spotless scan
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6

      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: temurin # Temurin is a distribution of adoptium
          java-version: 21

      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
        with:
          cache-disabled: true

      - run: ./gradlew spotlessCheck

  checkstyle:
    runs-on: ubuntu-latest
    name: Checkstyle scan
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6

      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: temurin # Temurin is a distribution of adoptium
          java-version: 21

      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
        with:
          cache-disabled: true

      - run: ./gradlew checkstyleMain checkstyleTest checkstyleIntegrationTest

  spotbugs:
    runs-on: ubuntu-latest
    name: Spotbugs scan
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6

      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: temurin # Temurin is a distribution of adoptium
          java-version: 21

      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
        with:
          cache-disabled: true

      - run: ./gradlew spotbugsMain

  check-permissions-order:
    runs-on: ubuntu-latest
    name: Check permissions orders
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
    - run: npm install yaml

    - name: Check permissions order
      run: |
        exclude_pattern="(^|/)roles_invalidxcontent.yml($|/)
                          (^|/)invalid_config/config.yml($|/)"
        # Set pattern to exclude certain files
        set -e
        exit_code=0
        for file in $(find . -name '*.yml' | grep -Ev "$exclude_pattern"); do
          if ! node check-permissions-order.js "$file" --slient; then
            exit_code=1
            echo "Error: $file requires changes. Run the following command to fix:"
            echo "node check-permissions-order.js $file --fix"
          fi
        done
        exit $exit_code