pre-commit-terraform/.github/workflows/pre-commit.yaml at master · saagie/pre-commit-terraform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
name: Common issues check

on:
  merge_group:
  pull_request:

permissions:
  contents: read

jobs:
  pre-commit:
    permissions:
      contents: write  # for pre-commit/action to push back fixes to PR branch
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        persist-credentials: false
    - run: >-
        git fetch --no-tags --prune --depth=1 origin
        +refs/heads/*:refs/remotes/origin/*

    - name: Get changed files
      id: file_changes
      env:
        BASE_REF: ${{ github.base_ref }}
        SHA: ${{ github.sha }}
      run: |
        export DIFF=$(git diff --name-only "origin/$BASE_REF" "$SHA")
        echo "Diff between $BASE_REF and $SHA"
        echo "files=$( echo "$DIFF" | xargs echo )" >> $GITHUB_OUTPUT

    - name: Install shfmt
      run: >-
        curl -L "$(
        curl -s https://api.github.com/repos/mvdan/sh/releases/latest
        | grep -o -E -m 1 "https://.+?linux_amd64"
        )"
        > shfmt
        && chmod +x shfmt && sudo mv shfmt /usr/bin/

    - name: Install shellcheck
      run: |
        sudo apt update && sudo apt install shellcheck

    - name: Install hadolint
      run: >-
        curl -L "$(
        curl -s https://api.github.com/repos/hadolint/hadolint/releases/latest
        | grep -o -E -i -m 1 "https://.+?/hadolint-linux-x86_64"
        )"
        > hadolint
        && chmod +x hadolint && sudo mv hadolint /usr/bin/
    # Needed for pre-commit fix push to succeed
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        fetch-depth: 0
        persist-credentials: false
        ref: ${{ github.event.pull_request.head.sha }}
        # Needed to trigger pre-commit workflow on autofix commit. Guide:
        # https://web.archive.org/web/20210731173012/https://github.community/t/required-check-is-expected-after-automated-push/187545/
        ssh-key: ${{ secrets.GHA_AUTOFIX_COMMIT_KEY }}
    # Skip terraform_tflint which interferes to commit pre-commit auto-fixes
    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
      with:
        python-version: '3.13'

    - name: Execute pre-commit
      uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  # v3.0.1
      env:
        SKIP: no-commit-to-branch
      with:
        extra_args: >-
          --color=always
          --show-diff-on-failure
          --files ${{ steps.file_changes.outputs.files}}

    # Needed to trigger pre-commit workflow on autofix commit
    - name: Push fixes
      if: failure()
      uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5  # v9.1.4
      with:
        # Determines the way the action fills missing author name and email.
        # Three options are available:
        # - github_actor -> UserName <UserName@users.noreply.github.com>
        # - user_info -> Your Display Name <your-actual@email.com>
        # - github_actions -> github-actions <email associated with the github logo>
        # Default: github_actor
        default_author: github_actor
        # The message for the commit.
        # Default: 'Commit from GitHub Actions (name of the workflow)'
        message: '[pre-commit] Autofix violations'