Skip to content

Commit 838d0e1

Browse files
ajitpratap0Ajit Pratap Singh
ajitpratap0
and
Ajit Pratap Singh
authored
feat: Rewrite GitHub Action shell scripts in Go (#251) (#310)
* feat(#251): rewrite GitHub Action entrypoint in Go * fix: sanitize file paths for GoSec G304 --------- Co-authored-by: Ajit Pratap Singh <ajitpratapsingh@Ajits-Mac-mini-2655.local>
1 parent 1a4d95e commit 838d0e1

File tree

2 files changed

+378
-171
lines changed

2 files changed

+378
-171
lines changed

‎action/entrypoint.sh‎

Lines changed: 3 additions & 171 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,9 @@
11
#!/usr/bin/env bash
2-
# GoSQLX GitHub Action Entrypoint
3-
# Finds SQL files, runs gosqlx lint + validate, outputs GitHub Actions annotations.
4-
#
5-
# Environment variables (set by action.yml or manually for local testing):
6-
# SQL_FILES - glob pattern for SQL files (default: **/*.sql)
7-
# RULES - comma-separated lint rules (optional)
8-
# SEVERITY - severity threshold: error, warning, info (default: warning)
9-
# CONFIG - path to .gosqlx.yml config file (optional)
10-
# GOSQLX_BIN - path to gosqlx binary (default: gosqlx)
11-
2+
# GoSQLX GitHub Action Entrypoint — thin wrapper around `gosqlx action`.
3+
# All logic now lives in the Go CLI (cmd/gosqlx/cmd/action.go).
124
set -euo pipefail
135

14-
SQL_FILES="${SQL_FILES:-**/*.sql}"
15-
RULES="${RULES:-}"
16-
SEVERITY="${SEVERITY:-warning}"
17-
CONFIG="${CONFIG:-}"
186
GOSQLX_BIN="${GOSQLX_BIN:-gosqlx}"
19-
TIMEOUT="${TIMEOUT:-600}"
207

218
# Resolve gosqlx binary
229
if ! command -v "$GOSQLX_BIN" &>/dev/null; then
@@ -30,159 +17,4 @@ if ! command -v "$GOSQLX_BIN" &>/dev/null; then
3017
fi
3118
fi
3219

33-
echo "Using gosqlx: $GOSQLX_BIN"
34-
echo "SQL file pattern: $SQL_FILES"
35-
echo "Severity threshold: $SEVERITY"
36-
37-
# --- Find SQL files ---
38-
FILES=()
39-
if [[ "$SQL_FILES" == "**/*.sql" ]]; then
40-
while IFS= read -r -d '' f; do
41-
FILES+=("$f")
42-
done < <(find . -type f -name "*.sql" -print0 2>/dev/null | sort -z)
43-
elif [[ "$SQL_FILES" == "*.sql" ]]; then
44-
while IFS= read -r -d '' f; do
45-
FILES+=("$f")
46-
done < <(find . -maxdepth 1 -type f -name "*.sql" -print0 2>/dev/null | sort -z)
47-
else
48-
# Use find with sanitized pattern to avoid command injection
49-
shopt -s globstar nullglob 2>/dev/null || true
50-
# Sanitize: only allow safe glob characters
51-
SAFE_PATTERN=$(echo "$SQL_FILES" | sed 's/[^a-zA-Z0-9_.*/?\/\-]//g')
52-
while IFS= read -r -d '' f; do
53-
FILES+=("$f")
54-
done < <(find . -type f -path "./$SAFE_PATTERN" -print0 2>/dev/null | sort -z)
55-
fi
56-
57-
if [ ${#FILES[@]} -eq 0 ]; then
58-
echo "::warning::No SQL files found matching pattern: $SQL_FILES"
59-
exit 0
60-
fi
61-
62-
echo "Found ${#FILES[@]} SQL file(s)"
63-
64-
# --- Build common flags ---
65-
LINT_FLAGS=()
66-
VALIDATE_FLAGS=()
67-
68-
if [ -n "$CONFIG" ] && [ -f "$CONFIG" ]; then
69-
echo "Using config: $CONFIG"
70-
export GOSQLX_CONFIG="$CONFIG"
71-
fi
72-
73-
if [ -n "$RULES" ]; then
74-
# Pass rules as repeated --rule flags if supported, otherwise log
75-
IFS=',' read -ra RULE_LIST <<< "$RULES"
76-
for rule in "${RULE_LIST[@]}"; do
77-
LINT_FLAGS+=(--rule "$(echo "$rule" | xargs)")
78-
done
79-
fi
80-
81-
LINT_ERRORS=0
82-
LINT_WARNINGS=0
83-
VALIDATE_ERRORS=0
84-
TOTAL_VALID=0
85-
EXIT_CODE=0
86-
87-
# --- Run lint + validate on each file ---
88-
for file in "${FILES[@]}"; do
89-
# Strip leading ./
90-
display_file="${file#./}"
91-
92-
# --- Validate (with timeout) ---
93-
TIMEOUT_CMD=""
94-
if command -v timeout &>/dev/null; then
95-
TIMEOUT_CMD="timeout $TIMEOUT"
96-
elif command -v gtimeout &>/dev/null; then
97-
TIMEOUT_CMD="gtimeout $TIMEOUT"
98-
fi
99-
if output=$($TIMEOUT_CMD "$GOSQLX_BIN" validate "$file" 2>&1); then
100-
TOTAL_VALID=$((TOTAL_VALID + 1))
101-
else
102-
VALIDATE_ERRORS=$((VALIDATE_ERRORS + 1))
103-
# Check if it was a timeout
104-
if [ $? -eq 124 ]; then
105-
echo "::error file=${display_file}::Validation timed out after ${TIMEOUT}s"
106-
fi
107-
# Parse output for line-level annotations if possible
108-
while IFS= read -r line; do
109-
if [[ "$line" =~ [Ll]ine[[:space:]]*([0-9]+) ]]; then
110-
lineno="${BASH_REMATCH[1]}"
111-
echo "::error file=${display_file},line=${lineno}::${line}"
112-
else
113-
echo "::error file=${display_file}::${line}"
114-
fi
115-
done <<< "$output"
116-
fi
117-
118-
# --- Lint ---
119-
lint_output=$("$GOSQLX_BIN" lint "$file" 2>&1) || true
120-
if [ -n "$lint_output" ] && ! echo "$lint_output" | grep -qi "no violations\|no issues\|0 violation"; then
121-
while IFS= read -r line; do
122-
if [ -z "$line" ]; then continue; fi
123-
124-
# Determine annotation level
125-
level="warning"
126-
if echo "$line" | grep -qi "error"; then
127-
level="error"
128-
LINT_ERRORS=$((LINT_ERRORS + 1))
129-
elif echo "$line" | grep -qi "warning"; then
130-
LINT_WARNINGS=$((LINT_WARNINGS + 1))
131-
else
132-
level="notice"
133-
fi
134-
135-
# Extract line number if present
136-
if [[ "$line" =~ [Ll]ine[[:space:]]*([0-9]+) ]]; then
137-
lineno="${BASH_REMATCH[1]}"
138-
echo "::${level} file=${display_file},line=${lineno}::${line}"
139-
else
140-
echo "::${level} file=${display_file}::${line}"
141-
fi
142-
done <<< "$lint_output"
143-
fi
144-
done
145-
146-
# --- Summary ---
147-
echo ""
148-
echo "=============================="
149-
echo " GoSQLX Results Summary"
150-
echo "=============================="
151-
echo " Files scanned: ${#FILES[@]}"
152-
echo " Validation passed: ${TOTAL_VALID}"
153-
echo " Validation errors: ${VALIDATE_ERRORS}"
154-
echo " Lint errors: ${LINT_ERRORS}"
155-
echo " Lint warnings: ${LINT_WARNINGS}"
156-
echo "=============================="
157-
158-
# Write GitHub Actions step summary if available
159-
if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
160-
cat >> "$GITHUB_STEP_SUMMARY" <<EOF
161-
162-
## GoSQLX Lint + Validation Results
163-
164-
| Metric | Count |
165-
|--------|-------|
166-
| Files Scanned | ${#FILES[@]} |
167-
| Validation Passed | ${TOTAL_VALID} |
168-
| Validation Errors | ${VALIDATE_ERRORS} |
169-
| Lint Errors | ${LINT_ERRORS} |
170-
| Lint Warnings | ${LINT_WARNINGS} |
171-
EOF
172-
fi
173-
174-
# --- Exit code based on severity threshold ---
175-
case "$SEVERITY" in
176-
error)
177-
[ $VALIDATE_ERRORS -gt 0 ] || [ $LINT_ERRORS -gt 0 ] && EXIT_CODE=1
178-
;;
179-
warning)
180-
[ $VALIDATE_ERRORS -gt 0 ] || [ $LINT_ERRORS -gt 0 ] || [ $LINT_WARNINGS -gt 0 ] && EXIT_CODE=1
181-
;;
182-
info)
183-
# Fail on anything
184-
[ $VALIDATE_ERRORS -gt 0 ] || [ $LINT_ERRORS -gt 0 ] || [ $LINT_WARNINGS -gt 0 ] && EXIT_CODE=1
185-
;;
186-
esac
187-
188-
exit $EXIT_CODE
20+
exec "$GOSQLX_BIN" action

0 commit comments

Comments
 (0)