mirror of
https://github.com/containers/podman.git
synced 2026-07-25 22:47:15 -04:00
5db2203255
Update the file after the updates I did in container-libs for it based on the review from Miloslav there. It will check that we use pinned actions with a version comment so renovate can update it. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
48 lines
1.7 KiB
Python
Executable File
48 lines
1.7 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
|
|
"""
|
|
Verify contents of .github/workflows/ci.yml meets some basic expectations
|
|
"""
|
|
|
|
import sys
|
|
import os
|
|
import unittest
|
|
import yaml
|
|
import re
|
|
|
|
# Assumes directory structure of this file relative to repo.
|
|
SCRIPT_DIRPATH = os.path.dirname(os.path.realpath(__file__))
|
|
REPO_ROOT = os.path.realpath(os.path.join(SCRIPT_DIRPATH, '..', '..'))
|
|
|
|
|
|
class TestCase(unittest.TestCase):
|
|
|
|
CI_YAML = None
|
|
|
|
def setUp(self):
|
|
with open(os.path.join(REPO_ROOT, '.github/workflows/ci.yml')) as ci_yaml:
|
|
self.CI_YAML = yaml.safe_load(ci_yaml.read())
|
|
|
|
# Critical for the merge protection to work as we only block on this task.
|
|
def test_success_deps(self):
|
|
"""success task depends on all others"""
|
|
all_tasks = list(self.CI_YAML['jobs'].keys())
|
|
# need to remove success from the list as it cannot depend on itself
|
|
all_tasks.remove('success')
|
|
needs = self.CI_YAML['jobs']['success']['needs']
|
|
self.assertCountEqual(needs, all_tasks)
|
|
|
|
def test_gh_actions_are_pinned_by(self):
|
|
"""ensure all actions are pinned by digest and have version comment"""
|
|
# Note local paths are allowed, i.e. uses: ./.github/workflows/lima.yml
|
|
pattern = re.compile(r"uses:\s+(?:(\./[\w./-]+)(?:\s+#.*)?|([\w.-]+/[\w./-]+)@([a-f0-9]{40})\s+#\s*(.+))$")
|
|
dir = os.path.join(REPO_ROOT, '.github/workflows')
|
|
for name in os.listdir(dir):
|
|
with open(os.path.join(dir, name)) as file:
|
|
for i, line in enumerate(file, 1):
|
|
if 'uses:' in line:
|
|
self.assertRegex(line, pattern, msg=f"Action must be pinned with a version number comment, file: .github/workflows/{name}:{i}")
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|