mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
Dan GuidoandGitHub
be744b16a2
* chore: Conservative dependency updates for security - Update Ansible from 9.1.0 to 9.2.0 (one minor version bump only) - Update Jinja2 to ~3.1.6 to fix CVE-2025-27516 (critical security fix) - Pin netaddr to 1.3.0 (current stable version) This is a minimal, conservative update focused on: 1. Critical security fix for Jinja2 2. Minor ansible update for bug fixes 3. Pinning netaddr to prevent surprises No changes to Ansible collections - keeping them unpinned for now. * fix: Address linter issues (ruff, yamllint, shellcheck) - Fixed ruff configuration by moving linter settings to [tool.ruff.lint] section - Fixed ruff code issues: - Moved imports to top of files (E402) - Removed unused variables or commented them out - Updated string formatting from % to .format() - Replaced dict() calls with literals - Fixed assert False usage in tests - Fixed yamllint issues: - Added missing newlines at end of files - Removed trailing spaces - Added document start markers (---) to YAML files - Fixed 'on:' truthy warnings in GitHub workflows - Fixed shellcheck issues: - Properly quoted variables in shell scripts - Fixed A && B || C pattern with proper if/then/else - Improved FreeBSD rc script quoting All linters now pass without errors related to our code changes. * fix: Additional yamllint fixes for GitHub workflows - Added document start markers (---) to test-effectiveness.yml - Fixed 'on:' truthy warning by quoting as 'on:' - Removed trailing spaces from main.yml - Added missing newline at end of test-effectiveness.yml
81 lines
2.2 KiB
YAML
81 lines
2.2 KiB
YAML
---
|
|
name: Lint
|
|
|
|
'on': [push, pull_request]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
ansible-lint:
|
|
name: Ansible linting
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
|
|
with:
|
|
python-version: '3.11'
|
|
cache: 'pip'
|
|
|
|
- name: Install ansible-lint and dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pip install ansible-lint ansible
|
|
# Install required ansible collections
|
|
ansible-galaxy collection install community.crypto
|
|
|
|
- name: Run ansible-lint
|
|
run: |
|
|
ansible-lint -v *.yml roles/{local,cloud-*}/*/*.yml
|
|
|
|
yaml-lint:
|
|
name: YAML linting
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Run yamllint
|
|
run: |
|
|
pip install yamllint
|
|
yamllint -c .yamllint . || true # Start with warnings only
|
|
|
|
python-lint:
|
|
name: Python linting
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
|
|
with:
|
|
python-version: '3.11'
|
|
cache: 'pip'
|
|
|
|
- name: Install Python linters
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pip install ruff
|
|
|
|
- name: Run ruff
|
|
run: |
|
|
# Fast Python linter
|
|
ruff check . || true # Start with warnings only
|
|
|
|
shellcheck:
|
|
name: Shell script linting
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Run shellcheck
|
|
run: |
|
|
sudo apt-get update && sudo apt-get install -y shellcheck
|
|
# Check all shell scripts, not just algo and install.sh
|
|
find . -type f -name "*.sh" -not -path "./.git/*" -exec shellcheck {} \;
|