feat: se-team-hubのreusable workflowsを移設し、repository-templateからリポジトリ構成を導入 #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| determine-changes: | |
| name: Determine changed files | |
| runs-on: ubuntu-latest | |
| outputs: | |
| github_actions: ${{ steps.changed-files.outputs.github_actions_any_changed }} | |
| github_actions_ci: ${{ steps.changed-files.outputs.github_actions_ci_any_changed }} | |
| renovate_config: ${{ steps.changed-files.outputs.renovate_config_any_changed }} | |
| md: ${{ steps.changed-files.outputs.md_any_changed }} | |
| json5: ${{ steps.changed-files.outputs.json5_any_changed }} | |
| json5_files: ${{ steps.changed-files.outputs.json5_all_changed_files }} | |
| toml: ${{ steps.changed-files.outputs.toml_any_changed }} | |
| yaml: ${{ steps.changed-files.outputs.yaml_any_changed }} | |
| steps: | |
| - name: Checkout the main repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Determine changed files | |
| id: changed-files | |
| uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6 | |
| with: | |
| files_yaml: | | |
| github_actions: | |
| - .github/workflows/** | |
| github_actions_ci: | |
| - .github/workflows/ci.yaml | |
| renovate_config: | |
| - .github/renovate.json5 | |
| md: | |
| - '**/*.md' | |
| - .markdownlint-cli2.yaml | |
| json5: | |
| - '**/*.json5' | |
| toml: | |
| - '**/*.toml' | |
| - .tombi.toml | |
| yaml: | |
| - '**/*.yml' | |
| - '**/*.yaml' | |
| - .yamllint.yaml | |
| lint-gh-actions: | |
| name: Lint GitHub Actions | |
| needs: determine-changes | |
| if: ${{ needs.determine-changes.outputs.github_actions == 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| security-events: write | |
| steps: | |
| - name: Checkout the main repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Run actionlint | |
| if: github.event_name != 'pull_request' | |
| run: | | |
| go install github.com/rhysd/actionlint/cmd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12 | |
| "$(go env GOPATH)/bin/actionlint" -color | |
| - name: Run actionlint (reviewdog) | |
| if: github.event_name == 'pull_request' | |
| uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1.72.0 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| reporter: github-pr-review | |
| fail_level: error | |
| - name: Run zizmor | |
| uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 | |
| with: | |
| version: 'v1.24.1' | |
| online-audits: false | |
| advanced-security: false | |
| annotations: true | |
| - name: Run zizmor (SARIF upload) | |
| if: >- | |
| ${{ | |
| always() && | |
| github.event.repository.private == false && | |
| (github.event_name != 'pull_request' || | |
| github.event.pull_request.head.repo.full_name == github.repository) | |
| }} | |
| uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 | |
| with: | |
| version: 'v1.24.1' | |
| online-audits: false | |
| advanced-security: true | |
| # validate-renovate-config: | |
| # name: Validate Renovate config | |
| # needs: determine-changes | |
| # if: >- | |
| # ${{ needs.determine-changes.outputs.renovate_config == 'true' || | |
| # needs.determine-changes.outputs.github_actions_ci == 'true' }} | |
| # runs-on: ubuntu-latest | |
| # permissions: | |
| # contents: read | |
| # steps: | |
| # - name: Checkout the main repository | |
| # uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # with: | |
| # persist-credentials: false | |
| # - name: Set up Node.js | |
| # uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| # with: | |
| # node-version: 24 | |
| # - name: Validate Renovate config | |
| # run: | | |
| # npx --yes --package renovate@43.150.0 \ | |
| # renovate-config-validator .github/renovate.json5 | |
| # lint-markdown: | |
| # name: Lint Markdown | |
| # needs: determine-changes | |
| # if: >- | |
| # ${{ needs.determine-changes.outputs.md == 'true' || | |
| # needs.determine-changes.outputs.github_actions_ci == 'true' }} | |
| # runs-on: ubuntu-latest | |
| # permissions: | |
| # contents: read | |
| # pull-requests: write | |
| # steps: | |
| # - name: Checkout the main repository | |
| # uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # with: | |
| # persist-credentials: false | |
| # - name: Lint Markdown | |
| # if: github.event_name != 'pull_request' | |
| # run: npx --yes markdownlint-cli2@0.22.1 . | |
| # - name: Set up reviewdog | |
| # if: github.event_name == 'pull_request' | |
| # uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1.5.0 | |
| # with: | |
| # reviewdog_version: 'v0.21.0' | |
| # - name: Lint Markdown (reviewdog) | |
| # if: github.event_name == 'pull_request' | |
| # env: | |
| # REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # run: | | |
| # markdownlint_rc=0 | |
| # npx --yes markdownlint-cli2@0.22.1 . > /tmp/markdownlint-report.txt 2>&1 || markdownlint_rc=$? | |
| # reviewdog_rc=0 | |
| # reviewdog < /tmp/markdownlint-report.txt \ | |
| # -efm="%f:%l:%c %m" \ | |
| # -efm="%f:%l %m" \ | |
| # -name=markdownlint \ | |
| # -reporter=github-pr-review \ | |
| # -fail-level=error || reviewdog_rc=$? | |
| # if [ $markdownlint_rc -ne 0 ] && ! grep -Eq '^[^:]+:[0-9]+(:[0-9]+)? ' /tmp/markdownlint-report.txt; then | |
| # echo "::error title=markdownlint::markdownlint failed before producing parseable diagnostics" | |
| # exit $markdownlint_rc | |
| # fi | |
| # exit $reviewdog_rc | |
| # lint-json5: | |
| # name: Lint JSON5 | |
| # needs: determine-changes | |
| # if: >- | |
| # ${{ needs.determine-changes.outputs.json5 == 'true' || | |
| # needs.determine-changes.outputs.github_actions_ci == 'true' }} | |
| # runs-on: ubuntu-latest | |
| # permissions: | |
| # contents: read | |
| # steps: | |
| # - name: Checkout the main repository | |
| # uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # with: | |
| # persist-credentials: false | |
| # - name: Check JSON5 syntax | |
| # env: | |
| # CHANGED_JSON5_FILES: ${{ needs.determine-changes.outputs.json5_files }} | |
| # run: | | |
| # readarray -t json5_files < <( | |
| # printf '%s\n' "${CHANGED_JSON5_FILES}" | tr ' ' '\n' | sed '/^$/d' | |
| # ) | |
| # if [ ${#json5_files[@]} -eq 0 ]; then | |
| # readarray -d '' -t json5_files < <( | |
| # find . -type f -name '*.json5' -not -path './.git/*' -print0 | |
| # ) | |
| # fi | |
| # if [ ${#json5_files[@]} -eq 0 ]; then | |
| # echo 'No JSON5 files found.' | |
| # exit 0 | |
| # fi | |
| # exit_code=0 | |
| # for json5_file in "${json5_files[@]}"; do | |
| # npx --yes json5@2.2.3 --validate "$json5_file" || exit_code=1 | |
| # done | |
| # exit $exit_code | |
| # lint-toml: | |
| # name: Lint TOML | |
| # needs: determine-changes | |
| # if: >- | |
| # ${{ needs.determine-changes.outputs.toml == 'true' || | |
| # needs.determine-changes.outputs.github_actions_ci == 'true' }} | |
| # runs-on: ubuntu-latest | |
| # permissions: | |
| # contents: read | |
| # pull-requests: write | |
| # steps: | |
| # - name: Checkout the main repository | |
| # uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # with: | |
| # persist-credentials: false | |
| # - name: Install Tombi | |
| # uses: tombi-toml/setup-tombi@df24458044353545055a12fe0d0742df9d3c5bea # v1.1.2 | |
| # with: | |
| # version: '1.1.2' | |
| # - name: Lint TOML | |
| # if: github.event_name != 'pull_request' | |
| # run: tombi lint | |
| # - name: Set up reviewdog | |
| # if: github.event_name == 'pull_request' | |
| # uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1.5.0 | |
| # with: | |
| # reviewdog_version: 'v0.21.0' | |
| # - name: Lint TOML (reviewdog) | |
| # if: github.event_name == 'pull_request' | |
| # env: | |
| # REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # NO_COLOR: '1' | |
| # run: | | |
| # lint_rc=0 | |
| # tombi lint --quiet > /tmp/tombi-lint-report.txt 2>&1 || lint_rc=$? | |
| # gawk ' | |
| # match($0, /^[[:space:]]*(Warning|Error):[[:space:]]*(.*)$/, m) { | |
| # severity = m[1]; message = m[2]; next | |
| # } | |
| # match($0, /^[[:space:]]*at[[:space:]]+(.*):([0-9]+):([0-9]+)/, m) { | |
| # printf "%s:%s:%s: %s: %s\n", m[1], m[2], m[3], substr(severity, 1, 1), message | |
| # } | |
| # ' /tmp/tombi-lint-report.txt > /tmp/tombi-lint-report.efm.txt | |
| # reviewdog_rc=0 | |
| # reviewdog < /tmp/tombi-lint-report.efm.txt \ | |
| # -efm="%f:%l:%c: %t: %m" \ | |
| # -name=tombi-lint \ | |
| # -reporter=github-pr-review \ | |
| # -fail-level=error || reviewdog_rc=$? | |
| # if [ $lint_rc -ne 0 ] && [ ! -s /tmp/tombi-lint-report.efm.txt ]; then | |
| # echo "::error title=tombi::tombi lint failed before producing parseable diagnostics" | |
| # cat /tmp/tombi-lint-report.txt | |
| # exit $lint_rc | |
| # fi | |
| # exit $reviewdog_rc | |
| # - name: Format TOML | |
| # run: tombi format | |
| # - name: Suggest TOML format changes (reviewdog) | |
| # if: github.event_name == 'pull_request' | |
| # uses: reviewdog/action-suggester@aa38384ceb608d00f84b4690cacc83a5aba307ff # v1.24.0 | |
| # with: | |
| # github_token: ${{ secrets.GITHUB_TOKEN }} | |
| # tool_name: tombi-format | |
| # cleanup: 'false' | |
| # - name: Check TOML format | |
| # run: git diff --exit-code | |
| # lint-yaml: | |
| # name: Lint YAML | |
| # needs: determine-changes | |
| # if: >- | |
| # ${{ needs.determine-changes.outputs.yaml == 'true' || | |
| # needs.determine-changes.outputs.github_actions_ci == 'true' }} | |
| # runs-on: ubuntu-latest | |
| # permissions: | |
| # contents: read | |
| # pull-requests: write | |
| # steps: | |
| # - name: Checkout the main repository | |
| # uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # with: | |
| # persist-credentials: false | |
| # - name: Install uv | |
| # if: github.event_name != 'pull_request' | |
| # uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| # with: | |
| # version: '0.11.16' | |
| # - name: Lint YAML | |
| # if: github.event_name != 'pull_request' | |
| # run: uvx --from "yamllint==1.38.0" yamllint . | |
| # - name: Lint YAML (reviewdog) | |
| # if: github.event_name == 'pull_request' | |
| # uses: reviewdog/action-yamllint@f01d8a48fd8d89f89895499fca2cff09f9e9e8c0 # v1.21.0 | |
| # with: | |
| # github_token: ${{ secrets.GITHUB_TOKEN }} | |
| # reporter: github-pr-review | |
| # fail_level: error | |
| # yamllint_flags: . | |
| check-prek: | |
| name: Check prek | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout the main repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Check prek | |
| uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2.0.4 | |
| with: | |
| prek-version: 'v0.4.1' | |
| extra-args: '--all-files --skip no-commit-to-branch' | |
| # check-typos: | |
| # name: Check typos | |
| # runs-on: ubuntu-latest | |
| # permissions: | |
| # contents: read | |
| # checks: write | |
| # pull-requests: write | |
| # steps: | |
| # - name: Checkout the main repository | |
| # uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # with: | |
| # persist-credentials: false | |
| # - name: Check spelling | |
| # if: github.event_name != 'pull_request' | |
| # uses: crate-ci/typos@aca895bf05aec0cb7dffa6f94495e923224d9f17 # v1.46.2 | |
| # with: | |
| # files: | | |
| # . | |
| # .github/** | |
| # - name: Check spelling (reviewdog) | |
| # if: github.event_name == 'pull_request' | |
| # uses: reviewdog/action-typos@d5eb1bbcd1b3bfde596f6eeb470322727862fe98 # v1.19.0 | |
| # with: | |
| # github_token: ${{ secrets.GITHUB_TOKEN }} | |
| # reporter: github-pr-review | |
| # fail_level: error | |
| # typos_flags: --hidden . | |
| # lint-commit-messages: | |
| # name: Lint commit messages | |
| # runs-on: ubuntu-latest | |
| # steps: | |
| # - name: Checkout the main repository | |
| # uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # with: | |
| # fetch-depth: 0 | |
| # persist-credentials: false | |
| # - name: Set up Commitizen | |
| # uses: commitizen-tools/setup-cz@96c75e6ae9632047f2c9b4025b9dd1624b40de8f # v0.9.1 | |
| # with: | |
| # python-version: '3.x' | |
| # version: '4.16.2' | |
| # - name: Lint commit messages on push | |
| # if: github.event_name == 'push' | |
| # run: cz check --rev-range ${{ github.event.before }}..${{ github.sha }} | |
| # - name: Lint commit messages on pull request | |
| # if: github.event_name == 'pull_request' | |
| # run: cz check --rev-range ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} |