fix(do-7299): replace Docker image with composite+binary for ARM64 support

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @DriveWealth/devops

.github/workflows/pull-requests.yml

@@ -45,6 +45,9 @@ jobs:
  - name: "Code Quality Analysis"
  run: make test-lint
  integration-test:
+ # Requires TOKEN_INTEGRATION_TESTS secret (PAT with access to gh-codeowners org).
+ # Skip in forks where this secret is not available.
+ if: ${{ secrets.TOKEN_INTEGRATION_TESTS != '' }}
  strategy:
  fail-fast: false
  matrix:

.github/workflows/test-action.yml

@@ -0,0 +1,39 @@
+name: Test action (amd64 + arm64)
+
+on:
+ pull_request:
+ branches: [ main ]
+ workflow_dispatch: {}
+
+jobs:
+ test:
+ name: test (${{ matrix.runner }})
+ strategy:
+ fail-fast: false
+ matrix:
+ include:
+ - runner: ubuntu-latest
+ arch: amd64
+ - runner: runs-on/pool=small-arm64
+ arch: arm64
+ runs-on: ${{ matrix.runner }}
+ steps:
+ - uses: actions/checkout@v4
+
+ - name: Create minimal CODEOWNERS for validation
+ run: |
+ mkdir -p .github
+ # Use a user that definitely exists so owners check passes
+ echo "* @DriveWealth/devops" > .github/CODEOWNERS
+
+ - name: Run codeowners-validator (${{ matrix.arch }})
+ uses: ./
+ with:
+ # Only run syntax/files checks — no token needed, no external API calls
+ checks: "syntax,files"
+ repository_path: "."
+
+ - name: Confirm binary arch
+ run: |
+ file $(which codeowners-validator) 2>/dev/null || \
+ file /usr/local/bin/codeowners-validator

README.md

@@ -1,3 +1,18 @@
+> [!NOTE]
+> **DriveWealth fork** — This is not a true fork. It is a shim that replaces the
+> upstream Docker-based action with a composite action that downloads the official
+> [`mszostok/codeowners-validator`](https://github.com/mszostok/codeowners-validator)
+> binary directly from GitHub Releases, enabling ARM64 runner support.
+>
+> - Pinned to **v0.7.2** to avoid the GitHub App token scope regression in v0.7.3+
+> (see [upstream issue #143](https://github.com/mszostok/codeowners-validator/issues/143))
+> - The upstream Docker image (`ghcr.io/mszostok/codeowners-validator:v0.7.2`) is AMD64-only;
+> v0.7.2 ships a `Linux_arm64` binary which this action uses instead
+> - Reference as `DriveWealth/codeowners-validator@<sha>` — do **not** use a tag,
+> tags point to the upstream release, not this shim
+>
+> Tracked in [DO-7299](https://drivewealth.atlassian.net/browse/DO-7299).
+
 <br/>
 <br/>
 <p align="center">

action.yml

@@ -58,10 +58,41 @@ inputs:
  required: false
 
 runs:
- using: 'docker'
- image: 'docker://ghcr.io/mszostok/codeowners-validator:v0.7.2'
- env:
- ENVS_PREFIX: "INPUT"
+ using: "composite"
+ steps:
+ - name: Install codeowners-validator
+ shell: bash
+ run: |
+ ARCH=$(uname -m)
+ case "$ARCH" in
+ x86_64) ARCH="x86_64" ;;
+ aarch64) ARCH="arm64" ;;
+ esac
+ TMP=$(mktemp -d)
+ curl -sSL "https://github.com/mszostok/codeowners-validator/releases/download/v0.7.2/codeowners-validator_0.7.2_Linux_${ARCH}.tar.gz" \
+ | tar -xz -C "$TMP"
+ sudo mv "$TMP/codeowners-validator" /usr/local/bin/codeowners-validator
+ sudo chmod +x /usr/local/bin/codeowners-validator
+
+ - name: Run codeowners-validator
+ shell: bash
+ env:
+ # Composite actions do not automatically set INPUT_* env vars the way Docker/JS actions do.
+ # codeowners-validator reads config via ENVS_PREFIX=INPUT, so we set INPUT_* explicitly.
+ ENVS_PREFIX: "INPUT"
+ INPUT_GITHUB_ACCESS_TOKEN: ${{ inputs.github_access_token }}
+ INPUT_GITHUB_BASE_URL: ${{ inputs.github_base_url }}
+ INPUT_GITHUB_UPLOAD_URL: ${{ inputs.github_upload_url }}
+ INPUT_EXPERIMENTAL_CHECKS: ${{ inputs.experimental_checks }}
+ INPUT_CHECKS: ${{ inputs.checks }}
+ INPUT_REPOSITORY_PATH: ${{ inputs.repository_path }}
+ INPUT_CHECK_FAILURE_LEVEL: ${{ inputs.check_failure_level }}
+ INPUT_NOT_OWNED_CHECKER_SKIP_PATTERNS: ${{ inputs.not_owned_checker_skip_patterns }}
+ INPUT_OWNER_CHECKER_REPOSITORY: ${{ inputs.owner_checker_repository }}
+ INPUT_OWNER_CHECKER_IGNORED_OWNERS: ${{ inputs.owner_checker_ignored_owners }}
+ INPUT_OWNER_CHECKER_ALLOW_UNOWNED_PATTERNS: ${{ inputs.owner_checker_allow_unowned_patterns }}
+ INPUT_OWNER_CHECKER_OWNERS_MUST_BE_TEAMS: ${{ inputs.owner_checker_owners_must_be_teams }}
+ run: codeowners-validator
 
 branding:
  icon: "shield"

hack/run-lint.sh

@@ -23,7 +23,7 @@ host::install::golangci() {
  export PATH="${TMP_DIR}/bin:${PATH}"
 
  shout "Install the golangci-lint ${GOLANGCI_LINT_VERSION} locally to a tempdir..."
- curl -sfSL -o "${TMP_DIR}/golangci-lint.sh" https://install.goreleaser.com/github.com/golangci/golangci-lint.sh
+ curl -sfSL -o "${TMP_DIR}/golangci-lint.sh" https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh
  chmod 700 "${TMP_DIR}/golangci-lint.sh"
 
  "${TMP_DIR}/golangci-lint.sh" -b "${TMP_DIR}/bin" ${GOLANGCI_LINT_VERSION}