Merge remote-tracking branch 'remotes/from/ce/main' #38932
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Run linters | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| push: | |
| branches: | |
| - main | |
| - release/** | |
| concurrency: | |
| group: ${{ github.head_ref || github.run_id }}-lint | |
| cancel-in-progress: true | |
| jobs: | |
| setup: | |
| name: Setup | |
| runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-22.04-x64"]') }} | |
| permissions: | |
| actions: read | |
| contents: read | |
| id-token: write | |
| issues: read | |
| pull-requests: read | |
| outputs: | |
| changed-files: ${{ steps.changed-files.outputs.changed-files }} | |
| workflow-trigger: ${{ steps.metadata.outputs.workflow-trigger }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/metadata | |
| id: metadata | |
| - if: steps.metadata.outputs.is-ent-repo == 'true' | |
| id: vault-auth | |
| name: Vault Authenticate | |
| run: vault-auth | |
| - if: steps.metadata.outputs.is-ent-repo == 'true' | |
| id: vault-secrets | |
| name: Fetch Vault Secrets | |
| uses: hashicorp/vault-action@892a26828f195e65540a40b4768ae4571f51ebfc # v4.0.0 | |
| with: | |
| url: ${{ steps.vault-auth.outputs.addr }} | |
| caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }} | |
| token: ${{ steps.vault-auth.outputs.token }} | |
| secrets: | | |
| kv/data/github/${{ github.repository }}/github-token token | ELEVATED_GITHUB_TOKEN; | |
| - name: Ensure Go modules are cached | |
| uses: ./.github/actions/set-up-go | |
| with: | |
| github-token: ${{ steps.metadata.outputs.is-ent-repo != 'true' && secrets.ELEVATED_GITHUB_TOKEN || steps.vault-secrets.outputs.ELEVATED_GITHUB_TOKEN }} | |
| no-restore: true # don't download them on a cache hit | |
| - uses: ./.github/actions/install-tools | |
| name: Ensure Vault tools are cached | |
| with: | |
| no-restore: true # don't download them on a cache hit | |
| - uses: ./.github/actions/changed-files | |
| id: changed-files | |
| with: | |
| github-token: ${{ steps.metadata.outputs.is-ent-repo != 'true' && secrets.ELEVATED_GITHUB_TOKEN || steps.vault-secrets.outputs.ELEVATED_GITHUB_TOKEN }} | |
| deprecations: | |
| name: Deprecated functions | |
| runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-22.04-x64"]') }} | |
| needs: setup | |
| if: | | |
| needs.setup.outputs.workflow-trigger == 'schedule' || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'go_app') || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'go_tests') || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'quality_code') | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: ./.github/actions/set-up-go | |
| with: | |
| github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }} | |
| - uses: ./.github/actions/install-tools # for staticcheck | |
| - run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com | |
| - run: make ci-deprecations | |
| name: Check deprecations | |
| codechecker: | |
| name: Code checks | |
| runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-22.04-x64"]') }} | |
| needs: setup | |
| if: | | |
| needs.setup.outputs.workflow-trigger == 'schedule' || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'go_app') || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'go_tests') || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'proto') || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'quality_code') | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: ./.github/actions/set-up-go | |
| with: | |
| github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }} | |
| - uses: ./.github/actions/install-tools # for buf | |
| - run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com | |
| # Note: if there is a function we want to ignore the nilnil check for, | |
| # You can add 'ignore-nil-nil-function-check' somewhere in the | |
| # godoc for the function. | |
| - run: make ci-vet-codechecker | |
| name: Check custom linters (non-blocking) | |
| continue-on-error: true | |
| - run: make protolint | |
| name: Protobuf lint | |
| generate-delta: | |
| name: Protobuf generate delta | |
| runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-22.04-x64"]') }} | |
| needs: setup | |
| if: | | |
| needs.setup.outputs.workflow-trigger == 'schedule' || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'go_app') || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'go_tests') || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'proto') | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/set-up-go | |
| with: | |
| github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }} | |
| - uses: ./.github/actions/install-tools # for buf and protoc-* | |
| - run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com | |
| - name: Check generate delta | |
| run: make prep check-proto-delta | |
| format: | |
| name: Format | |
| runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-22.04-x64"]') }} | |
| needs: setup | |
| if: | | |
| needs.setup.outputs.workflow-trigger == 'schedule' || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'go_app') || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'go_tests') || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'proto') || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'quality_code') | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/set-up-go | |
| with: | |
| github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }} | |
| - uses: ./.github/actions/install-tools # for buf and gofumpt | |
| - run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com | |
| - name: Go format | |
| run: make prep check-go-fmt | |
| - name: Protobuf format | |
| run: | | |
| echo "Using buf version $(buf --version)" | |
| make check-proto-fmt | |
| semgrep: | |
| name: Semgrep | |
| runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-22.04-x64"]') }} | |
| needs: setup | |
| if: | | |
| needs.setup.outputs.workflow-trigger == 'schedule' || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'go_app') || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'go_tests') || | |
| contains(fromJSON(needs.setup.outputs.changed-files).groups, 'quality_code') | |
| container: | |
| image: returntocorp/semgrep@sha256:cfad18cfb6536aa48ad5a71017207a10320b4e17e3b2bd7b7de27b42dc9651e7 #v1.58 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Run Semgrep Rules | |
| run: semgrep ci --include '*.go' --config 'tools/semgrep/ci' |