nerdctl/.github/workflows/workflow-lint.yml at main · containerd/nerdctl · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
name: lint

on:
  push:
    branches:
      - main
      - 'release/**'
  pull_request:

permissions:
  contents: read

jobs:
  # Runs golangci to ensure that:
  # 1. the tooling is working on the target platform
  # 2. the linter is happy
  # 3. for canary (if there is a canary go version), does lint for all supported goos
  lint-go:
    name: "go${{ inputs.hack }}"
    uses: $/.github/workflows/job-lint-go.yml
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-26.04
            goos: linux
          - runner: ubuntu-26.04
            goos: freebsd
          - runner: macos-15
            goos: darwin
          # FIXME: this is currently failing in a nonsensical way, so, running on linux instead...
          # - runner: windows-2022
          - runner: ubuntu-26.04
            goos: windows
          # Additionally lint for canary
          # FIXME: failing since the release of go1.27rc1
          # - runner: ubuntu-26.04
          #   goos: linux
          #   canary: true
    with:
      timeout: 10
      go-version: "1.26"
      runner: ubuntu-26.04
      # Note: in GitHub yaml world, if `matrix.canary` is undefined, and is passed to `inputs.canary`, the job
      # will not run. However, if you test it, it will coerce to `false`, hence:
      canary: ${{ matrix.canary && true || false }}
      goos: ${{ matrix.goos }}

  # Run common project checks (commits, licenses, etc)
  lint-project-checks:
    name: "project checks"
    uses: $/.github/workflows/job-lint-project.yml
    with:
      timeout: 5
      go-version: "1.26"
      runner: ubuntu-26.04

  # Runs the gomodjail static analysis gate, that verifies that the Go modules annotated
  # `gomodjail:confined` in go.mod cannot reach a denied capability (filesystem, network,
  # exec, raw syscalls, ...).
  # https://github.com/AkihiroSuda/gomodjail
  # To run locally, use `make lint-gomodjail-all`.
  lint-gomodjail:
    name: "gomodjail"
    timeout-minutes: 10
    runs-on: ubuntu-26.04
    env:
      GOTOOLCHAIN: local
    steps:
      - name: "Init: checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: "Init: install go"
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version: "1.26"
          check-latest: true
          # This workflow also runs on push, so the setup-go cache is disabled
          # for zizmor's cache-poisoning audit
          cache: false

      - name: "Init: install dev-tools"
        run: |
          echo "::group:: make install-dev-tools"
          make install-dev-tools
          echo "::endgroup::"

      - name: "Run"
        run: |
          NO_COLOR=true make lint-gomodjail-all

  # Report the dependencies that do not appear to be adopted by a trusted project.
  # Advisory only: this job always succeeds, the findings show up as annotations.
  lint-deps:
    name: "deps"
    uses: $/.github/workflows/job-lint-deps.yml
    with:
      timeout: 10
      go-version: "1.26"
      runner: ubuntu-26.04

  # Lint for shell and yaml files
  lint-other:
    name: "other"
    uses: $/.github/workflows/job-lint-other.yml
    with:
      timeout: 5
      runner: ubuntu-26.04

  # Verify we can actually build on all supported platforms, and a bunch of architectures
  build-for-go:
    name: "build for${{ inputs.hack }}"
    uses: $/.github/workflows/job-build.yml
    strategy:
      fail-fast: false
      matrix:
        include:
          - go-version: "1.26"
          # Additionally build for canary
          # FIXME: failing since the release of go1.27rc1
          # - go-version: "1.26"
          #   canary: true
    with:
      timeout: 10
      go-version: ${{ matrix.go-version }}
      runner: ubuntu-26.04
      canary: ${{ matrix.canary && true || false }}

  zizmor:
    name: "zizmor"
    runs-on: ubuntu-26.04
    steps:
      - name: "Init: checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 1
          persist-credentials: false
      - name: "Run: zizmor"
        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b  # v0.8.0
        with:
          inputs: .github/workflows
          # Do not send workflow diagnostics to GitHub Advanced Security code scanning in this project right now.
          # Keep this as a local CI check.
          advanced-security: false