Docs: Get them up #4
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validate Workflows | |
| permissions: | |
| contents: read | |
| on: | |
| pull_request: | |
| paths: | |
| - .github/workflows/** | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: stable | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-registry- | |
| - name: Install zizmor | |
| run: cargo install --force zizmor | |
| - name: Validate all workflows | |
| working-directory: .github/workflows | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| BASE_REF: ${{ github.base_ref }} | |
| run: | | |
| # Exit on any error | |
| set -euo pipefail | |
| # Initialize error flag | |
| has_errors=0 | |
| # Validate inputs | |
| if [ -z "${BASE_REF:-}" ]; then | |
| echo "::error::BASE_REF is not set" | |
| exit 1 | |
| fi | |
| # Properly escape the base ref for use in git commands | |
| base_ref=$(printf '%q' "$BASE_REF") | |
| # Get list of changed files with error handling | |
| changed_files=$(git diff --name-only "origin/${base_ref}" 2>/dev/null | \ | |
| grep -E '^\.github/workflows/[^/]+\.yml$' || true) | |
| if [ -z "$changed_files" ]; then | |
| echo "No workflow files changed" | |
| exit 0 | |
| fi | |
| # Loop through changed workflow files | |
| while IFS= read -r file; do | |
| [ -z "$file" ] && continue | |
| # Safely handle filenames | |
| filename=$(basename -- "$file") | |
| # Skip non-yaml files | |
| if [[ ! "$filename" =~ \.(ya?ml)$ ]]; then | |
| continue | |
| } | |
| echo "Validating $filename..." | |
| if ! zizmor "$filename" 2>/dev/null; then | |
| echo "::error::Validation failed for $filename" | |
| has_errors=1 | |
| fi | |
| done <<< "$changed_files" | |
| # Exit with error if any validation failed | |
| if [ "$has_errors" -eq 1 ]; then | |
| echo "::error::One or more workflow validations failed" | |
| exit 1 | |
| fi | |
| echo "All workflows validated successfully" |