diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..99240f2 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +* @DriveWealth/devops diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml deleted file mode 100644 index 7108979..0000000 --- a/.github/workflows/codeql-analysis.yml +++ /dev/null @@ -1,47 +0,0 @@ -name: "CodeQL" - -on: - push: - branches: [ main ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ main ] - schedule: - - cron: '15 15 * * 2' - -jobs: - analyze: - name: Analyze - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - - strategy: - fail-fast: false - matrix: - language: [ 'go' ] - # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ] - # Learn more: - # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed - - steps: - - name: Checkout repository - uses: actions/checkout@v3 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v1 - with: - languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - # queries: ./path/to/local/query, your-org/your-repo/queries@main - - - name: Autobuild - uses: github/codeql-action/autobuild@v1 - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v1 diff --git a/.github/workflows/pull-requests.yml b/.github/workflows/pull-requests.yml index e875c94..c1dbbca 100644 --- a/.github/workflows/pull-requests.yml +++ b/.github/workflows/pull-requests.yml @@ -45,6 +45,9 @@ jobs: - name: "Code Quality Analysis" run: make test-lint integration-test: + # Requires TOKEN_INTEGRATION_TESTS secret (PAT with access to gh-codeowners org). + # Skip in forks where this secret is not available. + if: ${{ secrets.TOKEN_INTEGRATION_TESTS != '' }} strategy: fail-fast: false matrix: diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml new file mode 100644 index 0000000..88b68a9 --- /dev/null +++ b/.github/workflows/test-action.yml @@ -0,0 +1,39 @@ +name: Test action (amd64 + arm64) + +on: + pull_request: + branches: [ main ] + workflow_dispatch: {} + +jobs: + test: + name: test (${{ matrix.runner }}) + strategy: + fail-fast: false + matrix: + include: + - runner: ubuntu-latest + arch: amd64 + - runner: runs-on/pool=small-arm64 + arch: arm64 + runs-on: ${{ matrix.runner }} + steps: + - uses: actions/checkout@v4 + + - name: Create minimal CODEOWNERS for validation + run: | + mkdir -p .github + # Use a user that definitely exists so owners check passes + echo "* @DriveWealth/devops" > .github/CODEOWNERS + + - name: Run codeowners-validator (${{ matrix.arch }}) + uses: ./ + with: + # Only run syntax/files checks — no token needed, no external API calls + checks: "syntax,files" + repository_path: "." + + - name: Confirm binary arch + run: | + file $(which codeowners-validator) 2>/dev/null || \ + file /usr/local/bin/codeowners-validator diff --git a/README.md b/README.md index 0653666..026325c 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,18 @@ +> [!NOTE] +> **DriveWealth fork** — This is not a true fork. It is a shim that replaces the +> upstream Docker-based action with a composite action that downloads the official +> [`mszostok/codeowners-validator`](https://github.com/mszostok/codeowners-validator) +> binary directly from GitHub Releases, enabling ARM64 runner support. +> +> - Pinned to **v0.7.2** to avoid the GitHub App token scope regression in v0.7.3+ +> (see [upstream issue #143](https://github.com/mszostok/codeowners-validator/issues/143)) +> - The upstream Docker image (`ghcr.io/mszostok/codeowners-validator:v0.7.2`) is AMD64-only; +> v0.7.2 ships a `Linux_arm64` binary which this action uses instead +> - Reference as `DriveWealth/codeowners-validator@` — do **not** use a tag, +> tags point to the upstream release, not this shim +> +> Tracked in [DO-7299](https://drivewealth.atlassian.net/browse/DO-7299). +

diff --git a/action.yml b/action.yml index b08de56..07f2c90 100644 --- a/action.yml +++ b/action.yml @@ -58,10 +58,41 @@ inputs: required: false runs: - using: 'docker' - image: 'docker://ghcr.io/mszostok/codeowners-validator:v0.7.2' - env: - ENVS_PREFIX: "INPUT" + using: "composite" + steps: + - name: Install codeowners-validator + shell: bash + run: | + ARCH=$(uname -m) + case "$ARCH" in + x86_64) ARCH="x86_64" ;; + aarch64) ARCH="arm64" ;; + esac + TMP=$(mktemp -d) + curl -sSL "https://github.com/mszostok/codeowners-validator/releases/download/v0.7.2/codeowners-validator_0.7.2_Linux_${ARCH}.tar.gz" \ + | tar -xz -C "$TMP" + sudo mv "$TMP/codeowners-validator" /usr/local/bin/codeowners-validator + sudo chmod +x /usr/local/bin/codeowners-validator + + - name: Run codeowners-validator + shell: bash + env: + # Composite actions do not automatically set INPUT_* env vars the way Docker/JS actions do. + # codeowners-validator reads config via ENVS_PREFIX=INPUT, so we set INPUT_* explicitly. + ENVS_PREFIX: "INPUT" + INPUT_GITHUB_ACCESS_TOKEN: ${{ inputs.github_access_token }} + INPUT_GITHUB_BASE_URL: ${{ inputs.github_base_url }} + INPUT_GITHUB_UPLOAD_URL: ${{ inputs.github_upload_url }} + INPUT_EXPERIMENTAL_CHECKS: ${{ inputs.experimental_checks }} + INPUT_CHECKS: ${{ inputs.checks }} + INPUT_REPOSITORY_PATH: ${{ inputs.repository_path }} + INPUT_CHECK_FAILURE_LEVEL: ${{ inputs.check_failure_level }} + INPUT_NOT_OWNED_CHECKER_SKIP_PATTERNS: ${{ inputs.not_owned_checker_skip_patterns }} + INPUT_OWNER_CHECKER_REPOSITORY: ${{ inputs.owner_checker_repository }} + INPUT_OWNER_CHECKER_IGNORED_OWNERS: ${{ inputs.owner_checker_ignored_owners }} + INPUT_OWNER_CHECKER_ALLOW_UNOWNED_PATTERNS: ${{ inputs.owner_checker_allow_unowned_patterns }} + INPUT_OWNER_CHECKER_OWNERS_MUST_BE_TEAMS: ${{ inputs.owner_checker_owners_must_be_teams }} + run: codeowners-validator branding: icon: "shield" diff --git a/hack/run-lint.sh b/hack/run-lint.sh index d735e9e..2dcbd8c 100755 --- a/hack/run-lint.sh +++ b/hack/run-lint.sh @@ -23,7 +23,7 @@ host::install::golangci() { export PATH="${TMP_DIR}/bin:${PATH}" shout "Install the golangci-lint ${GOLANGCI_LINT_VERSION} locally to a tempdir..." - curl -sfSL -o "${TMP_DIR}/golangci-lint.sh" https://install.goreleaser.com/github.com/golangci/golangci-lint.sh + curl -sfSL -o "${TMP_DIR}/golangci-lint.sh" https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh chmod 700 "${TMP_DIR}/golangci-lint.sh" "${TMP_DIR}/golangci-lint.sh" -b "${TMP_DIR}/bin" ${GOLANGCI_LINT_VERSION}