static-checks.yml

name: Static analysis of scripts

on:
  # run on pull requests to the main branch
  pull_request:
    branches: [main]
  # run on pushes to the main branch
  push:
    branches: [main]

# implicitely set all other permissions to none
permissions:
  contents: read # actions/checkout

# cancel in progress builds for this workflow triggered by the same ref
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  flake8:
    name: Install and run Flake8 on Python scripts
    runs-on: ubuntu-latest
    steps:
      - name: Install flake8
        run: sudo apt update && sudo apt -y install file flake8

      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Run Flake8 and dependencies
        run: |
          . scripts/functions
          scan_files text/x-script.python flake8

  pylint:
    name: Install and run Pylint on Python scripts
    runs-on: ubuntu-latest
    steps:
      - name: Install Pylint and dependencies
        run: sudo apt update && sudo apt -y install file pylint python3-voluptuous

      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Run Pylint (error mode)
        run: |
          . scripts/functions
          scan_files text/x-script.python pylint --errors-only

  shellcheck:
    name: Install and run ShellCheck on shell scripts
    runs-on: ubuntu-latest
    steps:
      - name: Install ShellCheck
        run: sudo apt update && sudo apt -y install shellcheck file

      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Run ShellCheck
        run: |
          . scripts/functions

          # Ignore the double quoting warning, script authors have better
          # knowledge of variable contents, and we accept that in practice
          # "local" is implemented everywhere so it's OK to use even though
          # it's not strictly POSIX.
          export SHELLCHECK_OPTS="-e SC2086,SC3043"

          scan_files text/x-shellscript shellcheck