fhevm/.github/workflows/common-pull-request-lint.yml at 2aec79e3d03dd8d02470608234a4f62b8047d413 · zama-ai/fhevm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
name: common-pull-request

on:
  pull_request:

env:
  ACTIONLINT_VERSION: 1.6.27

permissions: {}

jobs:
  lint:
    name: common-pull-request/lint (bpr)
    permissions:
      contents: 'read' # Required to checkout repository code
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: 'false'
          fetch-depth: 0

      - name: actionlint
        uses: raven-actions/actionlint@01fce4f43a270a612932cb1c64d40505a029f821 # v2.0.0
        with:
            flags: "-ignore SC2001"

      - name: Ensure SHA pinned actions
        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@64418826697dcd77c93a8e4a1f7601a1942e57b5 # v3.0.18

      - name: Setup Node
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version: 20.x

      - name: Install commitlint
        run: |
          npm install @commitlint/config-conventional@^18 conventional-changelog-conventionalcommits @commitlint/types@^18
          npm install -g @commitlint/cli@^18

      - name: Validate all commits from PR
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: npx commitlint --config .github/config/commitlint.config.js --from "${BASE_SHA}" --to "${HEAD_SHA}" --verbose

  zizmor-sast-check:
    permissions:
      security-events: 'write' # Required to write security events for SAST results
      actions: 'read' # Required to read workflow run information
      contents: 'read' # Required to checkout repository code
    name: Zizmor SAST Check
    uses: zama-ai/ci-templates/.github/workflows/sast-zizmor.yml@7dafeba7efe0df52da9fb9dc0e8a84277a7dd34a