Proposal: adoption of `checkton` (runs ShellCheck on Tekton YAML files)

[chmeliik]

Hi 👋

I made https://github.com/chmeliik/checkton, a GitHub action that runs ShellCheck on scripts embedded in YAML files.

The main motivation was to use it on https://github.com/konflux-ci/build-definitions, a decently sized collection of Tasks, Pipelines and StepActions that could greatly benefit having its shell scripts linted. The PoC pull request introducing the linter is konflux-ci/build-definitions#1085. It may be interesting to note that the default mode of operation is "differential" - don't report existing issues, report only those introduced in a pull request.

Would you be interested in having this project be part of the tektoncd community?

Who will own it

• @chmeliik
• @vdemeester
• anyone else interested?

[vdemeester]

cc @tektoncd/governing-board

[vdemeester]

@chmeliik one question, it could be used standalone as well, am I right ? The reason I ask this is, we could also have a Task that does this somehow.

Another topic I want to bring in the discussion here, is tektoncd/catlin. This sounds like something that could be handled by catlin, maybe ? That said, tektoncd/catlin needs some refining, and it might benefit from migrating to a python based project to be more dynamic.

[chmeliik]

one question, it could be used standalone as well, am I right ? The reason I ask this is, we could also have a Task that does this somehow.

It could be, yeah. Apart from some bits in https://github.com/chmeliik/checkton/blob/main/src/action.sh, none of it is GH-actions specific.

This sounds like something that could be handled by catlin, maybe?

At first glance, I would say the goals are different. Catlin seems to be about linting Tekton-catalog specific concerns (?) while Checkton just runs ShellCheck on embedded scripts. One nice - if somewhat coincidental - feature of Checkton is that it technically works with any YAML, not just Tekton, as long as your embedded scripts start with #!shebangs. The Tekton-specific feature is just detection of script: attributes so that it catches scripts that don't start with shebangs as well. That would probably be lost by integrating into Catlin

[chmeliik]

we could also have a Task that does this somehow.

Would having a Tekton task increase the likelihood of adoption into the tektoncd org? Do you see it as a prerequisite?