ci.yml

name: Build and Test

on:
  pull_request:
  push:
  merge_group:
  workflow_dispatch:

# Don't grant any access by default
permissions: {}

jobs:
  # Set build metadata before running any other job so we can reuse them for
  # both the standandard and the slim images, and for verification as well.
  # We can't run this as part of the build-container-image job because it
  # runs multiple times due to its matrix configuration, leading to race
  # conditions when verifying container image labels.
  set-build-metadata:
    name: Set build metadata
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      CONTAINER_IMAGE_BUILD_DATE: ${{ steps.set-container-image-build-metadata.outputs.CONTAINER_IMAGE_BUILD_DATE }}
      CONTAINER_IMAGE_BUILD_REVISION: ${{ steps.set-container-image-build-metadata.outputs.CONTAINER_IMAGE_BUILD_REVISION }}
      CONTAINER_IMAGE_BUILD_VERSION: ${{ steps.set-container-image-build-metadata.outputs.CONTAINER_IMAGE_BUILD_VERSION }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set build metadata
        id: set-container-image-build-metadata
        run: |
          if [[ ${{ github.event_name }} == 'push' ]] || [[ ${{ github.event_name }} == 'merge_group' ]]; then
            BUILD_REVISION=${{ github.sha }}
          elif [[ ${{ github.event_name }} == 'pull_request' ]]; then
            BUILD_REVISION=${{ github.event.pull_request.head.sha }}
          else
            echo "[ERROR] Event not supported when setting build revision and build version"
            exit 1
          fi

          . scripts/build-metadata.sh

          if [ -z "${BUILD_DATE}" ]; then
            echo "[ERROR] BUILD_DATE is empty"
            exit 1
          fi

          if [ -z "${BUILD_REVISION}" ]; then
            echo "[ERROR] BUILD_REVISION is empty"
            exit 1
          fi

          if [ -z "${BUILD_VERSION}" ]; then
            echo "[ERROR] BUILD_VERSION is empty"
            exit 1
          fi

          echo "Build date (GH Actions workflow): ${BUILD_DATE}"
          echo "Build revision (GH Actions workflow): ${BUILD_REVISION}"
          echo "Build version (GH Actions workflow): ${BUILD_VERSION}"

          {
            echo "BUILD_DATE=${BUILD_DATE}"
            echo "BUILD_REVISION=${BUILD_REVISION}"
            echo "BUILD_VERSION=${BUILD_VERSION}"
          } >> "${GITHUB_ENV}"

          {
            echo "CONTAINER_IMAGE_BUILD_DATE=${BUILD_DATE}"
            echo "CONTAINER_IMAGE_BUILD_REVISION=${BUILD_REVISION}"
            echo "CONTAINER_IMAGE_BUILD_VERSION=${BUILD_VERSION}"
          } >> "${GITHUB_OUTPUT}"

  build-stages:
    name: Build and cache container image stages
    runs-on: ubuntu-latest
    concurrency:
      group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}-${{ github.event_name }}-build-stages-${{ matrix.stages.stage-name }}
      cancel-in-progress: true
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        stages:
          - stage-name: python-base
          - stage-name: base_image
          - stage-name: clang-format
          - stage-name: python-builder
          - stage-name: npm-builder
          - stage-name: tflint-plugins
          - stage-name: lintr-installer
          - stage-name: ruby-installer
          - stage-name: powershell-installer
          - stage-name: php-linters
    timeout-minutes: 120
    env:
      CONTAINER_IMAGE_ID: "ghcr.io/super-linter/super-linter:latest"
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Free Disk space
        shell: bash
        run: |
          sudo rm -rf /usr/local/lib/android || true
          sudo rm -rf /usr/share/dotnet || true
          sudo rm -rf /opt/ghc || true
          sudo rm -rf /usr/local/.ghcup || true

      - name: Build ${{ matrix.stages.stage-name }} stage
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile
          cache-from: type=registry,ref=${{ env.CONTAINER_IMAGE_ID }}-buildcache-${{ matrix.stages.stage-name }}
          load: true
          push: false
          secrets: |
            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
          target: ${{ matrix.stages.stage-name }}

  build-container-image:
    name: Build and Test
    runs-on: ubuntu-latest
    permissions:
      contents: read
    needs:
      - set-build-metadata
    concurrency:
      # Ref: https://docs.github.com/en/actions/learn-github-actions/contexts#github-context
      # github.head_ref: head_ref or source branch of the pull request
      # github.ref: ref of the branch that triggered the workflow
      group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}-${{ github.event_name }}-${{ matrix.images.target }}
      cancel-in-progress: true
    strategy:
      fail-fast: false
      matrix:
        images:
          - prefix: slim-
            target: slim
          - prefix: ""
            target: standard
    timeout-minutes: 120
    env:
      CONTAINER_IMAGE_ID: "ghcr.io/super-linter/super-linter:${{ matrix.images.prefix }}latest"
      CONTAINER_IMAGE_TARGET: "${{ matrix.images.target }}"
      CONTAINER_IMAGE_OUTPUT_IMAGE_NAME: "super-linter-${{ matrix.images.prefix }}latest"
      LINTER_VERSIONS_FILE_NAME: "${{ matrix.images.prefix }}linterVersions.txt"
      STAGES_BUILD_CACHE_CONTAINER_IMAGE_ID: "ghcr.io/super-linter/super-linter:latest"
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Free Disk space
        shell: bash
        run: |
          sudo rm -rf /usr/local/lib/android || true
          sudo rm -rf /usr/share/dotnet || true
          sudo rm -rf /opt/ghc || true
          sudo rm -rf /usr/local/.ghcup || true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build Image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile
          build-args: |
            BUILD_DATE=${{ needs.set-build-metadata.outputs.CONTAINER_IMAGE_BUILD_DATE }}
            BUILD_REVISION=${{ needs.set-build-metadata.outputs.CONTAINER_IMAGE_BUILD_REVISION }}
            BUILD_VERSION=${{ needs.set-build-metadata.outputs.CONTAINER_IMAGE_BUILD_VERSION }}
          cache-from: |
            type=registry,ref=${{ env.CONTAINER_IMAGE_ID }}-buildcache
            type=registry,ref=${{ env.STAGES_BUILD_CACHE_CONTAINER_IMAGE_ID }}-buildcache-base_image
            type=registry,ref=${{ env.STAGES_BUILD_CACHE_CONTAINER_IMAGE_ID }}-buildcache-clang-format
            type=registry,ref=${{ env.STAGES_BUILD_CACHE_CONTAINER_IMAGE_ID }}-buildcache-python-builder
            type=registry,ref=${{ env.STAGES_BUILD_CACHE_CONTAINER_IMAGE_ID }}-buildcache-npm-builder
            type=registry,ref=${{ env.STAGES_BUILD_CACHE_CONTAINER_IMAGE_ID }}-buildcache-tflint-plugins
            type=registry,ref=${{ env.STAGES_BUILD_CACHE_CONTAINER_IMAGE_ID }}-buildcache-lintr-installer
            type=registry,ref=${{ env.STAGES_BUILD_CACHE_CONTAINER_IMAGE_ID }}-buildcache-powershell-installer
            type=registry,ref=${{ env.STAGES_BUILD_CACHE_CONTAINER_IMAGE_ID }}-buildcache-php-linters
          outputs: type=docker,dest=/tmp/${{ env.CONTAINER_IMAGE_OUTPUT_IMAGE_NAME }}.tar
          push: false
          secrets: |
            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
          tags: |
            ${{ env.CONTAINER_IMAGE_ID }}
          target: "${{ matrix.images.target }}"

      # Load the image here because the docker/build-push-action doesn't support multiple exporters yet
      # Ref: https://github.com/docker/build-push-action/issues/413
      # Ref: https://github.com/moby/buildkit/issues/1555
      - name: Load image
        run: |
          docker load <"/tmp/${CONTAINER_IMAGE_OUTPUT_IMAGE_NAME}.tar"

      - name: Print environment info
        run: |
          make info

      - name: Upload ${{ env.CONTAINER_IMAGE_OUTPUT_IMAGE_NAME }} container image
        uses: actions/upload-artifact@v7.0.1
        with:
          name: ${{ env.CONTAINER_IMAGE_OUTPUT_IMAGE_NAME }}
          path: /tmp/${{ env.CONTAINER_IMAGE_OUTPUT_IMAGE_NAME }}.tar

      - name: Extract linter versions file
        run: |
          CONTAINER_ID="$(docker create "${CONTAINER_IMAGE_ID}")"
          docker cp "${CONTAINER_ID}:/action/linterVersions.txt" "${RUNNER_TEMP}/${LINTER_VERSIONS_FILE_NAME}"
          docker rm -v "${CONTAINER_ID}"
          cat "${RUNNER_TEMP}/${LINTER_VERSIONS_FILE_NAME}"

      - name: Upload ${{ env.LINTER_VERSIONS_FILE_NAME }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ env.LINTER_VERSIONS_FILE_NAME }}
          path: ${{ runner.temp }}/${{ env.LINTER_VERSIONS_FILE_NAME }}

  test-local-action:
    name: Test the Super-linter GitHub Action
    runs-on: ubuntu-latest
    needs: build-container-image
    permissions:
      contents: read
      issues: write
      packages: read
      pull-requests: write
      statuses: write
    strategy:
      matrix:
        images:
          - container-image-id: super-linter-latest
            prefix: ""
            target: standard
          - container-image-id: super-linter-slim-latest
            prefix: slim-
            target: slim
    env:
      CONTAINER_IMAGE_ID: "ghcr.io/super-linter/super-linter:${{ matrix.images.prefix }}latest"
      CONTAINER_IMAGE_TARGET: "${{ matrix.images.target }}"
      CONTAINER_IMAGE_OUTPUT_IMAGE_NAME: "super-linter-${{ matrix.images.prefix }}latest"
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Download ${{ env.CONTAINER_IMAGE_OUTPUT_IMAGE_NAME }} container image
        uses: actions/download-artifact@v8.0.1
        with:
          name: ${{ env.CONTAINER_IMAGE_OUTPUT_IMAGE_NAME }}
          path: /tmp

      - name: Load ${{ env.CONTAINER_IMAGE_OUTPUT_IMAGE_NAME }} container image
        run: |
          docker load --input "/tmp/${CONTAINER_IMAGE_OUTPUT_IMAGE_NAME}.tar"
          # Tag the loaded image with the reference in action.yml so that
          # running the local action uses the newly built image without
          # modifying action.yml in the working tree.
          ACTION_IMAGE="$(yq '.runs.image | sub("^docker://", "")' action.yml)"
          docker tag "${CONTAINER_IMAGE_ID}" "${ACTION_IMAGE}"
          docker image ls -a

      - name: Test Local Action (debug log)
        # Use ./ instead of $/ so the runner resolves action.yml at step runtime
        # against the locally loaded container image, rather than pulling the
        # image from the registry before the job steps run.
        uses: ./ # zizmor: ignore[self-repository]
        env:
          LOG_LEVEL: DEBUG
          CREATE_LOG_FILE: true
          REMOVE_ANSI_COLOR_CODES_FROM_OUTPUT: true
          VALIDATE_ALL_CODEBASE: false
          # Disable dependency security audits because we have dedicated jobs for those,
          # and we don't want to fail the whole linting job because vulnerabilities
          # might not necessarily be fixable until patches are out.
          VALIDATE_TRIVY: false
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_CONFIG_FILE: .gitleaks-ignore-tests.toml
          FILTER_REGEX_EXCLUDE: ".*(/test/linters/|CHANGELOG.md|/test/data/detect-files-scripts/|/test/data/test-repository-contents/).*"
          RENOVATE_SHAREABLE_CONFIG_PRESET_FILE_NAMES: "default.json,hoge.json"

      - name: Get the contents of the log file
        run: |
          sudo cat super-linter.log
          sudo rm -v super-linter.log

      - name: Test Local Action (default log)
        # Use ./ instead of $/ so the runner resolves action.yml at step runtime
        # against the locally loaded container image, rather than pulling the
        # image from the registry before the job steps run.
        uses: ./ # zizmor: ignore[self-repository]
        env:
          REMOVE_ANSI_COLOR_CODES_FROM_OUTPUT: true
          VALIDATE_ALL_CODEBASE: false
          # Disable dependency security audits because we have dedicated jobs for those,
          # and we don't want to fail the whole linting job because vulnerabilities
          # might not necessarily be fixable until patches are out.
          VALIDATE_TRIVY: false
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_CONFIG_FILE: .gitleaks-ignore-tests.toml
          FILTER_REGEX_EXCLUDE: ".*(/test/linters/|CHANGELOG.md|/test/data/detect-files-scripts/|/test/data/test-repository-contents/).*"

  build-test-suite-matrix:
    name: Build test suite matrix
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      matrix: ${{ steps.generate-matrix.outputs.test-cases }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Generate test cases matrix
        id: generate-matrix
        run: |
          TEST_TARGETS=$(awk '/^test:/ {p=1} p {if ($1 ~ /:$/) start=2; else start=1; for (i=start; i<=NF; ++i) if ($i != "\\") print $i; if ($NF != "\\") p=0}' Makefile | jq --compact-output --raw-input --slurp 'split("\n") | map(select(length > 0))')
          echo "TEST_TARGETS: ${TEST_TARGETS}"
          echo "test-cases=${TEST_TARGETS}" >> "${GITHUB_OUTPUT}"

  run-test-suite:
    name: Run test cases
    runs-on: ubuntu-latest
    permissions:
      contents: read
    needs:
      - set-build-metadata
      - build-container-image
      - build-test-suite-matrix
    strategy:
      # Continue running the rest of the test suite so we get feedback even if
      # there are failures in certain tests, such as when running npm-audit
      fail-fast: false
      matrix:
        test-case: ${{ fromJson(needs.build-test-suite-matrix.outputs.matrix) }}
        images:
          - container-image-id: super-linter-latest
            prefix: ""
            target: standard
          - container-image-id: super-linter-slim-latest
            prefix: slim-
            target: slim
        include:
          # Also run the test target to check if running the whole test suite
          # in the same execution environment prevents it from succeeding
          - test-case: test
    env:
      CONTAINER_IMAGE_ID: "ghcr.io/super-linter/super-linter:${{ matrix.images.prefix }}latest"
      CONTAINER_IMAGE_TARGET: "${{ matrix.images.target }}"
      CONTAINER_IMAGE_OUTPUT_IMAGE_NAME: "super-linter-${{ matrix.images.prefix }}latest"
      BUILD_DATE: ${{ needs.set-build-metadata.outputs.CONTAINER_IMAGE_BUILD_DATE }}
      BUILD_REVISION: ${{ needs.set-build-metadata.outputs.CONTAINER_IMAGE_BUILD_REVISION }}
      BUILD_VERSION: ${{ needs.set-build-metadata.outputs.CONTAINER_IMAGE_BUILD_VERSION }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Download ${{ env.CONTAINER_IMAGE_OUTPUT_IMAGE_NAME }} container image
        uses: actions/download-artifact@v8.0.1
        with:
          name: ${{ env.CONTAINER_IMAGE_OUTPUT_IMAGE_NAME }}
          path: /tmp

      - name: Load ${{ env.CONTAINER_IMAGE_OUTPUT_IMAGE_NAME }} container image
        run: |
          docker load --input "/tmp/${CONTAINER_IMAGE_OUTPUT_IMAGE_NAME}.tar"
          docker image ls -a

      - name: "Test case: ${{ env.CONTAINER_IMAGE_OUTPUT_IMAGE_NAME }} - ${{ matrix.test-case }}"
        run: |
          echo "Running: ${CONTAINER_IMAGE_OUTPUT_IMAGE_NAME} - ${MATRIX_TEST_CASE}"
          make "${MATRIX_TEST_CASE}"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MATRIX_TEST_CASE: ${{ matrix.test-case }}

  # The purpose of this job is to run only when the run-test-suite job runs to completion.
  # We can use this job as a required status check in a branch protection rule without
  # having to select each individual job that dynamically add to the test matrix.
  test-success-placeholder:
    name: Check if all the tests passed
    if: ${{ always() }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    needs:
      - run-test-suite
      - test-local-action
    steps:
      - name: Test suite success
        if: ${{ !(contains(needs.*.result, 'failure')) && !contains(needs.*.result, 'cancelled') && !contains(needs.*.result, 'skipped') }}
        run: exit 0
      - name: Test suite failures
        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
        run: exit 1

  preview-release-notes:
    if: github.event_name == 'pull_request' && github.repository == github.event.pull_request.head.repo.full_name && github.repository == 'super-linter/super-linter'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup authentication token
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" > .github-personal-access-token

      - name: Generate a preview of the release notes
        run: |
          make release-please-dry-run