Skip to content

Latest commit

 

History

History
201 lines (134 loc) · 7.38 KB

CONTRIBUTING.md

File metadata and controls

201 lines (134 loc) · 7.38 KB
Raw

Reporting an issue

To report a bug, please submit a new ticket on GitHub. It's helpful to search similar tickets before making it.

https://github.com/rhysd/actionlint/issues/new

Providing a reproducible workflow content is much appreciated. If only a small snippet of workflow is provided or no input is provided at all, such issue tickets may get lower priority since they are occasionally time consuming to investigate.

Sending a patch

Thank you for taking your time to improve this project. To send a patch, please submit a new pull request on GitHub. It's helpful to check if a similar patch was rejected in the past before making it. actionlint focuses on detecting mistakes so adding rules related to styles or conventions is basically not accepted.

https://github.com/rhysd/actionlint/pulls

Before submitting your PR, please ensure the following points:

  • Confirm build/tests/lints passed. How to run them is described in the following sections.
  • If you added a new feature, consider to add tests and explain it in the usage document.
  • If you added a new public API, consider to add tests and a doc comment for the API.

Development

make (3.81 or later) is useful to run each tasks and reduce redundant builds/tests.

How to build

go build ./cmd/actionlint
./actionlint -h

or

make build

make build generates some sources with go generate. When you want to avoid it, add SKIP_GO_GENERATE=1 to make arguments.

Since actionlint doesn't use any cgo features, setting CGO_ENABLED=0 environment variable is recommended to avoid troubles around linking libc. make build does this by default.

How to run tests

go test

or

make test

How to run lint

staticcheck is used to lint Go sources.

staticcheck ./...

or

make lint

How to run fuzzer

Fuzz tests use go-fuzz. Install go-fuzz and go-fuzz-build in your system.

Since there are multiple fuzzing targets, -func argument is necessary. Specify a target which you want to run.

# Create first corpus
go-fuzz-build ./fuzz

# Run fuzzer
go-fuzz -bin ./actionlint_fuzz-fuzz.zip -func FuzzParse

or

make fuzz FUZZ_FUNC=FuzzParse

How to release

When releasing v1.2.3 as example:

  1. Ensure all changes were already pushed to remote by checking git push origin master outputs Everything up-to-date
  2. Run bash ./scripts/bump-version.bash 1.2.3
  3. Wait until the CI release job completes successfully:
    • GoReleaser builds release binaries and make pre-release at GitHub and updates Homebrew formula
    • The CI job also updates version string in ./scripts/download-actionlint.bash
  4. Open the pre-release at release page with browser
  5. Write up release notes, uncheck pre-release checkbox and publish the new release
  6. Run changelog-from-release > CHANGELOG.md locally to update CHANGELOG.md and make a commit for the change
  7. Run git pull to merge upstream changes to local main branch and run git push origin main
  8. Update the playground by ./playground/deploy.bash if it is not updated yet for the release

How to generate the manual

actionlint.1 manual is generated from actionlint.1.ronn by ronn.

ronn ./man/actionlint.1.ronn

or

make ./man/actionlint.1

How to develop playground

Visit playground/README.md.

How to deploy playground

Run deploy.bash at root of repository. It does:

  1. Ensure to install dependencies and to build main.wasm
  2. Copy all assets to ./playground-dist directory
  3. Optimize main.wasm with wasm-opt which is a part of Binaryen toolchain
  4. Switch branch to gh-pages
  5. Move all files in ./playground-dist to root of repository and add to repository
  6. Make commit for deployment
# Prepare deployment
bash ./playground/deploy.bash
# Check it works fine by visiting localhost:1234
npm run serve
# If it looks good, deploy it
git push

Maintain popular_actions.go

popular_actions.go is generated automatically with go generate. The command runs generate-popular-actions script.

The script also can detect new releases of popular actions on GitHub by giving -d flag.

Detecting new release and updating popular_actions.go are run weekly on CI by generate workflow. Runs can be checked here.

Maintain all_webhooks.go

all_webhooks.go is a table all webhooks supported by GitHub Actions to trigger workflows. Note that not all webhooks are supported by GitHub Actions.

It is generated automatically with go generate. The command runs generate-webhook-events script.

It fetches events-that-trigger-workflows.md, parses the markdown document, and extracts webhook names and their types. For more details, see README.md at the script.

Updating all_webhooks.go is run weekly on CI by generate workflow.

Maintain actionlint-matcher.json

actionlint-matcher.json is a matcher configuration to extract error annotations from outputs of actionlint command. See the document for its usage.

The regular expression is complicated because it can matches to outputs which contain ANSI color escape sequences. So the JSON file is not modified manually.

It is generated by generate-actionlint-matcher script. See the README.md file for the usage of the script and how to run the tests for it.

Maintain availability.go

availability.go is a table for conversion from workflow key (like jobs.<job_id>.if) to availability of contexts and special functions. GitHub Actions limits contexts and functions in certain places. For example:

  • limited workflow keys can access secrets context
  • jobs.<job_id>.if and jobs.<job_id>.steps.if can use always() function.

availability.go is generated from the contexts document using generate-availability script. It is run through go generate in rule_expression.go. See the readme of the script for the usage of the script.

Update for availability.go is run weekly on CI by generate workflow.

Testing

  • All examples in 'Checks' document are put in the examples directory and tested in linter_test.go.
  • I cloned GitHub top 1000 repositories and extracted 1400+ workflow files. And I tried actionlint with the collected workflow files. All bugs found while the trial were fixed and I confirmed no more false positives.