chore(deps): update dependency rumdl to v0.2.31 #43651
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| ######################### | |
| ######################### | |
| ## Deploy Docker Image ## | |
| ######################### | |
| ######################### | |
| # | |
| # Documentation: | |
| # https://help.github.com/en/articles/workflow-syntax-for-github-actions | |
| # | |
| ####################################### | |
| # Start the job on all push to main # | |
| ####################################### | |
| name: "Build & Deploy - DEV" | |
| on: | |
| push: | |
| branches-ignore: | |
| - main | |
| paths-ignore: | |
| - .github/CONTRIBUTING.md | |
| - CHANGELOG.md | |
| - README.md | |
| - .github/workflows/slash-command-dispatch.yml | |
| - .github/workflows/help-command.yml | |
| - .github/workflows/build-command.yml | |
| pull_request: | |
| ############### | |
| # Set the Job # | |
| ############### | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.ref_name }}-${{ github.workflow }} | |
| cancel-in-progress: true | |
| jobs: | |
| ################################################################## | |
| # Producer: build the image, populate GHA buildx cache (no push) # | |
| ################################################################## | |
| build: | |
| name: Build Docker Image - DEV | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # Prevent duplicate run from happening when a forked push is committed | |
| if: (github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository) && !contains(github.event.head_commit.message, 'skip deploy') | |
| timeout-minutes: 90 | |
| outputs: | |
| image-tag: ${{ steps.meta.outputs.tags }} | |
| image-version: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} | |
| dockerfile: ${{ steps.setup.outputs.dockerfile }} | |
| cache-scope: ${{ steps.setup.outputs.cache-scope }} | |
| build-args: ${{ steps.setup.outputs.build-args }} | |
| is-quick: ${{ steps.setup.outputs.is-quick }} | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Free Disk space | |
| shell: bash | |
| run: | | |
| sudo rm -rf /usr/local/lib/android # will release about 10 GB if you don't need Android | |
| sudo rm -rf /usr/share/dotnet # will release about 20GB if you don't need .NET | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "$AGENT_TOOLSDIRECTORY" | |
| sudo rm -rf /opt/hostedtoolcache/CodeQL # large cache | |
| sudo rm -rf /opt/hostedtoolcache/go # Go toolcache | |
| - name: Docker Metadata action | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6 | |
| id: meta | |
| with: | |
| images: | | |
| ${{ github.repository }} | |
| - name: Select Dockerfile, cache scope, and build args | |
| id: setup | |
| shell: bash | |
| env: | |
| COMMIT_MSG: ${{ github.event.head_commit.message }} | |
| META_CREATED: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }} | |
| META_VERSION: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} | |
| META_REVISION: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }} | |
| run: | | |
| if [[ "${COMMIT_MSG}" == *"quick build"* ]]; then | |
| { | |
| echo "is-quick=true" | |
| echo "dockerfile=Dockerfile-quick" | |
| echo "cache-scope=dev-quick" | |
| echo "build-args<<EOF" | |
| echo "BUILD_DATE=${META_CREATED}" | |
| echo "BUILD_VERSION=${META_VERSION}" | |
| echo "BUILD_REVISION=${META_REVISION}" | |
| echo "MEGALINTER_BASE_IMAGE=ghcr.io/oxsecurity/megalinter:beta" | |
| echo "EOF" | |
| } >> "${GITHUB_OUTPUT}" | |
| else | |
| { | |
| echo "is-quick=false" | |
| echo "dockerfile=Dockerfile" | |
| echo "cache-scope=dev-main" | |
| echo "build-args<<EOF" | |
| echo "BUILD_DATE=${META_CREATED}" | |
| echo "BUILD_VERSION=${META_VERSION}" | |
| echo "BUILD_REVISION=${META_REVISION}" | |
| echo "EOF" | |
| } >> "${GITHUB_OUTPUT}" | |
| fi | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 | |
| # Build once and export the image as a Docker tarball. | |
| # DEV is read-only on the layer cache: it consumes the warm caches | |
| # produced by the BETA workflow on main and never writes back. Writing | |
| # a fresh cache for a throwaway PR branch costs ~14 min of cache export | |
| # per build that nobody else reads, so we skip `cache-to` entirely here. | |
| - name: Build MegaLinter Docker Image | |
| id: docker_build | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| continue-on-error: true | |
| with: | |
| context: . | |
| file: ${{ steps.setup.outputs.dockerfile }} | |
| platforms: linux/amd64 | |
| build-args: ${{ steps.setup.outputs.build-args }} | |
| secrets: | | |
| GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| cache-from: type=gha,scope=beta-main,ignore-error=true | |
| outputs: type=docker,dest=/tmp/megalinter-image.tar,compression=zstd,compression-level=3,force-compression=true | |
| timeout-minutes: 90 | |
| # Fallback: if the cached build above failed (e.g. GHA cache returned a | |
| # stale manifest pointing to an evicted blob — buildx surfaces this as | |
| # 'ERROR: blob sha256:...: not found'), rebuild from scratch with no | |
| # cache-from. Slower but never blocks on cache corruption. | |
| - name: Build MegaLinter Docker Image (no-cache fallback) | |
| if: steps.docker_build.outcome == 'failure' | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: . | |
| file: ${{ steps.setup.outputs.dockerfile }} | |
| platforms: linux/amd64 | |
| build-args: ${{ steps.setup.outputs.build-args }} | |
| secrets: | | |
| GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| outputs: type=docker,dest=/tmp/megalinter-image.tar,compression=zstd,compression-level=3,force-compression=true | |
| timeout-minutes: 90 | |
| - name: Upload image artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: megalinter-image | |
| path: /tmp/megalinter-image.tar | |
| retention-days: 1 | |
| if-no-files-found: error | |
| compression-level: 0 | |
| ############################################################### | |
| # Consumer: Run linter test cases against the cached image # | |
| ############################################################### | |
| test-cases: | |
| name: Run Test Cases - DEV | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # Require writing security events to upload SARIF file to security tab | |
| security-events: write | |
| timeout-minutes: 120 | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Free Disk space | |
| shell: bash | |
| run: | | |
| sudo rm -rf /usr/local/lib/android | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "$AGENT_TOOLSDIRECTORY" | |
| sudo rm -rf /opt/hostedtoolcache/CodeQL | |
| sudo rm -rf /opt/hostedtoolcache/go | |
| - name: Download image artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: megalinter-image | |
| path: /tmp | |
| - name: Load Docker image | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| docker load -i /tmp/megalinter-image.tar | |
| rm -f /tmp/megalinter-image.tar | |
| docker image ls | |
| - name: Run Test Cases | |
| shell: bash | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }} | |
| GH_REPOSITORY: ${{ github.repository }} | |
| HEAD_REF: ${{ github.head_ref }} | |
| REF_NAME: ${{ github.ref_name }} | |
| COMMIT_MSG: ${{ github.event.head_commit.message }} | |
| DOCKER_IMAGE: ${{ needs.build.outputs.image-tag }} | |
| GH_SHA: ${{ github.sha }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| GITHUB_REPOSITORY=$([ "$EVENT_NAME" == "pull_request" ] && echo "$PR_HEAD_REPO" || echo "$GH_REPOSITORY") | |
| GITHUB_BRANCH=$([ "$EVENT_NAME" == "pull_request" ] && echo "$HEAD_REF" || echo "$REF_NAME") | |
| CI_ENV="$(bash <(curl -s https://codecov.io/env)) -e GITHUB_ACTIONS" | |
| export CI_ENV | |
| TEST_KEYWORDS_TO_USE="" | |
| if [[ "${COMMIT_MSG}" == *"TEST_KEYWORDS="* ]]; then | |
| TEST_KEYWORDS_TO_USE=${COMMIT_MSG#*TEST_KEYWORDS=} | |
| echo "Run only tests with keywords ${TEST_KEYWORDS_TO_USE}" | |
| if [[ "${TEST_KEYWORDS_TO_USE}" =~ $'\r' ]]; then | |
| echo "Problem while parsing test keywords: switch back to all tests" | |
| TEST_KEYWORDS_TO_USE="" | |
| fi | |
| fi | |
| docker image ls | |
| # shellcheck disable=SC2086 | |
| docker run $CI_ENV -e TEST_CASE_RUN=true -e OUTPUT_FORMAT=text -e OUTPUT_FOLDER="${GH_SHA}" -e OUTPUT_DETAIL=detailed -e GITHUB_SHA="${GH_SHA}" -e GITHUB_REPOSITORY="${GITHUB_REPOSITORY}" -e GITHUB_BRANCH="${GITHUB_BRANCH}" -e GITHUB_TOKEN="${GITHUB_TOKEN}" -e TEST_KEYWORDS="${TEST_KEYWORDS_TO_USE}" -e MEGALINTER_VOLUME_ROOT="${GITHUB_WORKSPACE}" -v "/var/run/docker.sock:/var/run/docker.sock:rw" -v "${GITHUB_WORKSPACE}:/tmp/lint" "${DOCKER_IMAGE}" | |
| timeout-minutes: 120 | |
| - name: Archive production artifacts (test-cases) | |
| if: success() || failure() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: MegaLinter reports (test-cases) | |
| include-hidden-files: "true" | |
| path: | | |
| megalinter-reports | |
| mega-linter.log | |
| linter-helps.json | |
| linter-versions.json | |
| ############################################################### | |
| # Consumer: Run megalinter against the entire code base # | |
| ############################################################### | |
| run-all-code: | |
| name: Run against all code base - DEV | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| if: needs.build.outputs.is-quick != 'true' | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Free Disk space | |
| shell: bash | |
| run: | | |
| sudo rm -rf /usr/local/lib/android | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "$AGENT_TOOLSDIRECTORY" | |
| sudo rm -rf /opt/hostedtoolcache/CodeQL | |
| sudo rm -rf /opt/hostedtoolcache/go | |
| - name: Download image artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: megalinter-image | |
| path: /tmp | |
| - name: Load Docker image | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| docker load -i /tmp/megalinter-image.tar | |
| rm -f /tmp/megalinter-image.tar | |
| docker image ls | |
| - name: Run against all code base | |
| shell: bash | |
| env: | |
| DOCKER_IMAGE: ${{ needs.build.outputs.image-tag }} | |
| GH_REPOSITORY: ${{ github.repository }} | |
| GH_SHA: ${{ github.sha }} | |
| GH_TOKEN_VALUE: ${{ github.token }} | |
| GH_RUN_ID: ${{ github.run_id }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: docker run -e GITHUB_REPOSITORY="${GH_REPOSITORY}" -e GITHUB_SHA="${GH_SHA}" -e GITHUB_TOKEN="${GH_TOKEN_VALUE}" -e GITHUB_RUN_ID="${GH_RUN_ID}" -e GITHUB_TOKEN="${GITHUB_TOKEN}" -v "/var/run/docker.sock:/var/run/docker.sock:rw" -v "${GITHUB_WORKSPACE}:/tmp/lint" "${DOCKER_IMAGE}" | |
| timeout-minutes: 15 | |
| - name: Archive production artifacts (run-all-code) | |
| if: success() || failure() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: MegaLinter reports (run-all-code) | |
| include-hidden-files: "true" | |
| path: | | |
| megalinter-reports | |
| mega-linter.log | |
| linter-helps.json | |
| linter-versions.json | |
| ############################################################### | |
| # Consumer: mega-linter-runner tests against the cached image # | |
| ############################################################### | |
| runner-tests: | |
| name: mega-linter-runner tests - DEV | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| if: needs.build.outputs.is-quick != 'true' | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Free Disk space | |
| shell: bash | |
| run: | | |
| sudo rm -rf /usr/local/lib/android | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "$AGENT_TOOLSDIRECTORY" | |
| sudo rm -rf /opt/hostedtoolcache/CodeQL | |
| sudo rm -rf /opt/hostedtoolcache/go | |
| - name: Download image artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: megalinter-image | |
| path: /tmp | |
| - name: Load Docker image | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| docker load -i /tmp/megalinter-image.tar | |
| rm -f /tmp/megalinter-image.tar | |
| docker image ls | |
| - name: Setup Node | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: "24.x" | |
| - name: Install NPM dependencies | |
| run: cd mega-linter-runner && yarn install --frozen-lockfile && npm link | |
| - name: Run mega-linter-runner tests | |
| env: | |
| MEGALINTER_RELEASE: ${{ needs.build.outputs.image-version }} | |
| MEGALINTER_IMAGE: ${{ needs.build.outputs.image-tag }} | |
| run: cd mega-linter-runner && MEGALINTER_RELEASE="${MEGALINTER_RELEASE}" MEGALINTER_IMAGE="${MEGALINTER_IMAGE}" MEGALINTER_NO_DOCKER_PULL=true npm run test | |
| ############################################################### | |
| # Consumer: Trivy vulnerability scan # | |
| ############################################################### | |
| trivy: | |
| name: Trivy scan - DEV | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Free Disk space | |
| shell: bash | |
| run: | | |
| sudo rm -rf /usr/local/lib/android | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "$AGENT_TOOLSDIRECTORY" | |
| sudo rm -rf /opt/hostedtoolcache/CodeQL | |
| sudo rm -rf /opt/hostedtoolcache/go | |
| - name: Download image artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: megalinter-image | |
| path: /tmp | |
| - name: Load Docker image | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| docker load -i /tmp/megalinter-image.tar | |
| rm -f /tmp/megalinter-image.tar | |
| docker image ls | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| # renovate: datasource=github-releases depName=aquasecurity/trivy | |
| version: "v0.72.0" | |
| image-ref: "${{ needs.build.outputs.image-tag }}" | |
| format: 'table' | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| scanners: vuln | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| timeout: 15m0s | |
| # - name: Run OSV-Scanner vulnerability scanner | |
| # uses: google/osv-scanner-action/osv-scanner-action@v2.3.5 | |
| # with: | |
| # scan-args: |- | |
| # --docker ${{ needs.build.outputs.image-tag }} |