Skip to content

Commit 1142b6c

Browse files
yamatchayamatcha
authored
Merge pull request #907 from cybozu-go/lint-ci
Add linters for GHA
2 parents 91f0064 + 182ab70 commit 1142b6c

16 files changed

Lines changed: 232 additions & 9 deletions

‎.github/actions/dbtest/action.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,11 @@ runs:
1717
uses: ./.github/actions/setup-aqua
1818
- run: make setup
1919
shell: bash
20-
- run: make test-bkop MYSQL_VERSION=${{ inputs.mysql-version }}
20+
- env:
21+
MYSQL_VERSION: ${{ inputs.mysql-version }}
22+
run: make test-bkop MYSQL_VERSION="$MYSQL_VERSION"
2123
shell: bash
22-
- run: make test-dbop MYSQL_VERSION=${{ inputs.mysql-version }}
24+
- env:
25+
MYSQL_VERSION: ${{ inputs.mysql-version }}
26+
run: make test-dbop MYSQL_VERSION="$MYSQL_VERSION"
2327
shell: bash

‎.github/actions/e2e/action.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,15 @@ runs:
2828
- run: sudo mkdir /mnt/local-path-provisioner0 /mnt/local-path-provisioner1 /mnt/local-path-provisioner2
2929
shell: bash
3030
- name: Setup test cluster
31-
run: make start KUBERNETES_VERSION=${{ inputs.k8s-version }} MYSQL_VERSION=${{ inputs.mysql-version }} KIND_CONFIG=kind-config_actions.yaml
3231
working-directory: e2e
32+
env:
33+
KUBERNETES_VERSION: ${{ inputs.k8s-version }}
34+
MYSQL_VERSION: ${{ inputs.mysql-version }}
35+
run: make start KUBERNETES_VERSION="$KUBERNETES_VERSION" MYSQL_VERSION="$MYSQL_VERSION" KIND_CONFIG=kind-config_actions.yaml
3336
shell: bash
34-
- run: make test MYSQL_VERSION=${{ inputs.mysql-version }}
37+
- env:
38+
MYSQL_VERSION: ${{ inputs.mysql-version }}
39+
run: make test MYSQL_VERSION="$MYSQL_VERSION"
3540
working-directory: e2e
3641
shell: bash
3742
- run: make logs

‎.github/workflows/build-fluent-bit-container.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,14 @@ on:
1414
- ".github/workflows/build-fluent-bit-container.yaml"
1515
- "!**.md"
1616

17+
permissions: {}
18+
1719
jobs:
1820
build:
1921
runs-on: ${{ vars.IMAGE_BUILD_RUNNER || 'ubuntu-24.04' }}
22+
permissions:
23+
contents: read
24+
packages: write
2025
steps:
2126
- uses: actions/checkout@v6
2227
- uses: docker/setup-qemu-action@v3

‎.github/workflows/build-mysql-container.yaml‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,13 @@ on:
1414
- ".github/workflows/build-mysql-container.yaml"
1515
- "!**.md"
1616

17+
permissions: {}
18+
1719
jobs:
1820
filter:
1921
runs-on: ubuntu-24.04
22+
permissions:
23+
contents: read
2024
outputs:
2125
mysql-versions: ${{ steps.filter.outputs.mysql-versions }}
2226
steps:
@@ -42,6 +46,8 @@ jobs:
4246
if: ${{ (github.event_name == 'pull_request') && (needs.filter.outputs.mysql-versions != '[]') }}
4347
needs: filter
4448
runs-on: ${{ vars.IMAGE_BUILD_RUNNER || 'ubuntu-22.04' }}
49+
permissions:
50+
contents: read
4551
strategy:
4652
matrix:
4753
mysql-version: ${{ fromJson(needs.filter.outputs.mysql-versions) }}
@@ -59,8 +65,10 @@ jobs:
5965
- name: Export TAG file
6066
id: tag
6167
working-directory: containers
68+
env:
69+
MYSQL_VERSION: ${{ matrix.mysql-version }}
6270
run: |
63-
TAG=$(cat ./mysql/${{ matrix.mysql-version }}/TAG)
71+
TAG=$(cat "./mysql/$MYSQL_VERSION/TAG")
6472
echo "tag: $TAG"
6573
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
6674
@@ -80,8 +88,10 @@ jobs:
8088
&& chmod +x container-structure-test-linux-amd64 \
8189
&& sudo mv container-structure-test-linux-amd64 /usr/local/bin/container-structure-test
8290
- name: Run Container Structure Tests
91+
env:
92+
MYSQL_VERSION: ${{ matrix.mysql-version }}
8393
run: |
84-
container-structure-test test --image ghcr.io/cybozu-go/moco/mysql:${{ matrix.mysql-version }} --config ./containers/mysql/${{ matrix.mysql-version }}/container-structure-test.yaml
94+
container-structure-test test --image "ghcr.io/cybozu-go/moco/mysql:$MYSQL_VERSION" --config "./containers/mysql/$MYSQL_VERSION/container-structure-test.yaml"
8595
8696
- run: |
8797
swapon > swapon.txt
@@ -93,7 +103,10 @@ jobs:
93103
uses: ./.github/actions/setup-aqua
94104

95105
- name: Setup test cluster with local mysql image
96-
run: make start KUBERNETES_VERSION=${{ matrix.k8s-version }} MYSQL_VERSION=${{ matrix.mysql-version }} KIND_CONFIG=kind-config_actions.yaml USE_LOCAL_MYSQL_IMAGE=1
106+
env:
107+
KUBERNETES_VERSION: ${{ matrix.k8s-version }}
108+
MYSQL_VERSION: ${{ matrix.mysql-version }}
109+
run: make start KUBERNETES_VERSION="$KUBERNETES_VERSION" MYSQL_VERSION="$MYSQL_VERSION" KIND_CONFIG=kind-config_actions.yaml USE_LOCAL_MYSQL_IMAGE=1
97110
working-directory: e2e
98111

99112
- run: make test
@@ -111,6 +124,9 @@ jobs:
111124
if: ${{ (github.ref == 'refs/heads/main') && (needs.filter.outputs.mysql-versions != '[]') }}
112125
needs: filter
113126
runs-on: ${{ vars.IMAGE_BUILD_RUNNER || 'ubuntu-22.04' }}
127+
permissions:
128+
contents: read
129+
packages: write
114130
strategy:
115131
matrix:
116132
mysql-version: ${{ fromJson(needs.filter.outputs.mysql-versions) }}
@@ -128,8 +144,10 @@ jobs:
128144
- name: Export TAG file
129145
id: tag
130146
working-directory: containers
147+
env:
148+
MYSQL_VERSION: ${{ matrix.mysql-version }}
131149
run: |
132-
TAG=$(cat ./mysql/${{ matrix.mysql-version }}/TAG)
150+
TAG=$(cat "./mysql/$MYSQL_VERSION/TAG")
133151
echo "tag: $TAG"
134152
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
135153

‎.github/workflows/build-mysqld-exporter-container.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,14 @@ on:
1414
- ".github/workflows/build-mysqld-exporter-container.yaml"
1515
- "!**.md"
1616

17+
permissions: {}
18+
1719
jobs:
1820
build:
1921
runs-on: ${{ vars.IMAGE_BUILD_RUNNER || 'ubuntu-24.04' }}
22+
permissions:
23+
contents: read
24+
packages: write
2025
steps:
2126
- uses: actions/checkout@v6
2227
- uses: docker/setup-qemu-action@v3

‎.github/workflows/ci-e2e.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,18 @@ concurrency:
1111
group: ${{ github.workflow }}-${{ github.ref }}
1212
cancel-in-progress: true
1313

14+
permissions: {}
15+
1416
env:
1517
cache-version: 1
1618

1719
# CI tests with supported MySQL version.
1820
jobs:
1921
dbtest:
2022
name: Integration tests with MySQL
23+
permissions:
24+
contents: read
25+
pull-requests: read # Required for tj-actions/changed-files
2126
strategy:
2227
matrix:
2328
mysql-version: ["8.0.28", "8.0.43", "8.0.44", "8.0.45", "8.4.4", "8.4.8"]
@@ -38,6 +43,9 @@ jobs:
3843

3944
e2e:
4045
name: Supported Kubernetes versions End-to-End Tests
46+
permissions:
47+
contents: read
48+
pull-requests: read # Required for tj-actions/changed-files
4149
strategy:
4250
matrix:
4351
mysql-version: ["8.4.8"]
@@ -62,6 +70,9 @@ jobs:
6270

6371
e2e-mysql:
6472
name: Supported MySQL versions End-to-End Tests
73+
permissions:
74+
contents: read
75+
pull-requests: read # Required for tj-actions/changed-files
6576
strategy:
6677
matrix:
6778
mysql-version: ["8.0.28", "8.0.43", "8.0.44", "8.0.45", "8.4.4", "8.4.8"]
@@ -86,6 +97,9 @@ jobs:
8697

8798
upgrade:
8899
name: Upgrade Test
100+
permissions:
101+
contents: read
102+
pull-requests: read # Required for tj-actions/changed-files
89103
runs-on:
90104
group: moco
91105
steps:

‎.github/workflows/ci.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,17 @@ concurrency:
1010
group: ${{ github.workflow }}-${{ github.ref }}
1111
cancel-in-progress: true
1212

13+
permissions: {}
14+
1315
env:
1416
cache-version: 1
1517

1618
jobs:
1719
build:
1820
name: Build binaries
1921
runs-on: ubuntu-24.04
22+
permissions:
23+
contents: read
2024
steps:
2125
- uses: actions/checkout@v6
2226
- uses: actions/setup-go@v6
@@ -30,6 +34,8 @@ jobs:
3034
test:
3135
name: Small tests
3236
runs-on: ubuntu-22.04
37+
permissions:
38+
contents: read
3339
steps:
3440
- uses: actions/checkout@v6
3541
- uses: actions/setup-go@v6

‎.github/workflows/helm-release.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,13 @@ on:
55
tags:
66
- 'chart-v*'
77

8+
permissions: {}
9+
810
jobs:
911
build:
1012
runs-on: ubuntu-24.04
13+
permissions:
14+
contents: read
1115
steps:
1216
- name: Checkout
1317
uses: actions/checkout@v6
@@ -40,6 +44,8 @@ jobs:
4044
name: Publish charts on GitHub Pages
4145
runs-on: ubuntu-22.04
4246
needs: build
47+
permissions:
48+
contents: write
4349
steps:
4450
- uses: actions/checkout@v6
4551
with:

‎.github/workflows/helm.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,13 @@ on:
66
- "charts/**"
77
- '!**.md'
88

9+
permissions: {}
10+
911
jobs:
1012
lint-test:
1113
runs-on: ubuntu-24.04
14+
permissions:
15+
contents: read
1216

1317
steps:
1418
- name: Checkout

‎.github/workflows/mdbook.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,15 @@ on:
44
push:
55
branches:
66
- 'main'
7+
8+
permissions: {}
9+
710
jobs:
811
build:
912
name: Build book
1013
runs-on: ubuntu-24.04
14+
permissions:
15+
contents: read
1116
steps:
1217
- uses: actions/checkout@v6
1318
- name: Setup Aqua
@@ -22,6 +27,8 @@ jobs:
2227
name: Publish book on GitHub Pages
2328
runs-on: ubuntu-22.04
2429
needs: build
30+
permissions:
31+
contents: write
2532
steps:
2633
- uses: actions/checkout@v6
2734
with:

0 commit comments

Comments
 (0)