forked from rhysd/actionlint
-
Notifications
You must be signed in to change notification settings - Fork 0
/
rule_action.go
194 lines (170 loc) · 5.04 KB
/
rule_action.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
package actionlint
import (
"fmt"
"net/url"
"strconv"
"strings"
)
// RuleAction is a rule to check running action in steps of jobs.
// https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsuses
type RuleAction struct {
RuleBase
cache *LocalActionsCache
}
// NewRuleAction creates new RuleAction instance.
func NewRuleAction(cache *LocalActionsCache) *RuleAction {
return &RuleAction{
RuleBase: RuleBase{name: "action"},
cache: cache,
}
}
// VisitStep is callback when visiting Step node.
func (rule *RuleAction) VisitStep(n *Step) error {
e, ok := n.Exec.(*ExecAction)
if !ok || e.Uses == nil {
return nil
}
spec := e.Uses.Value
if strings.Contains(spec, "${{") && strings.Contains(spec, "}}") {
// Cannot parse specification made with interpolation. Give up
return nil
}
if strings.HasPrefix(spec, "./") {
// Relative to repository root
rule.checkLocalAction(spec, e)
return nil
}
if strings.HasPrefix(spec, "docker://") {
rule.checkDockerAction(spec, e)
return nil
}
rule.checkRepoAction(spec, e)
return nil
}
// Parse {owner}/{repo}@{ref} or {owner}/{repo}/{path}@{ref}
func (rule *RuleAction) checkRepoAction(spec string, exec *ExecAction) {
s := spec
idx := strings.IndexRune(s, '@')
if idx == -1 {
rule.invalidActionFormat(exec.Uses.Pos, spec, "ref is missing")
return
}
ref := s[idx+1:]
s = s[:idx] // remove {ref}
idx = strings.IndexRune(s, '/')
if idx == -1 {
rule.invalidActionFormat(exec.Uses.Pos, spec, "owner is missing")
return
}
owner := s[:idx]
s = s[idx+1:] // eat {owner}
repo := s
if idx := strings.IndexRune(s, '/'); idx >= 0 {
repo = s[:idx]
// path = s[idx+1:]
}
if owner == "" || repo == "" || ref == "" {
rule.invalidActionFormat(exec.Uses.Pos, spec, "owner and repo and ref should not be empty")
}
meta, ok := PopularActions[spec]
if !ok {
rule.debug("This action is not found in popular actions data set: %s", spec)
return
}
if meta.SkipInputs {
rule.debug("This action skips to check inputs: %s", spec)
return
}
rule.checkAction(meta, exec, func(m *ActionMetadata) string {
return strconv.Quote(spec)
})
}
func (rule *RuleAction) invalidActionFormat(pos *Pos, spec string, why string) {
rule.errorf(pos, "specifying action %q in invalid format because %s. available formats are \"{owner}/{repo}@{ref}\" or \"{owner}/{repo}/{path}@{ref}\"", spec, why)
}
// https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#example-using-the-github-packages-container-registry
func (rule *RuleAction) checkDockerAction(uri string, exec *ExecAction) {
tag := ""
tagExists := false
if idx := strings.IndexRune(uri[len("docker://"):], ':'); idx != -1 {
idx += len("docker://")
if idx < len(uri) {
tag = uri[idx+1:]
uri = uri[:idx]
tagExists = true
}
}
if _, err := url.Parse(uri); err != nil {
rule.errorf(
exec.Uses.Pos,
"URI for Docker container %q is invalid: %s (tag=%s)",
uri,
err.Error(),
tag,
)
}
if tagExists && tag == "" {
rule.errorf(exec.Uses.Pos, "tag of Docker action should not be empty: %q", uri)
}
}
// https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#example-using-action-in-the-same-repository-as-the-workflow
func (rule *RuleAction) checkLocalAction(path string, action *ExecAction) {
meta, err := rule.cache.FindMetadata(path)
if err != nil {
// Do not complain about the action does not exist (#25, #40).
// It seems a common pattern that the local action does not exist in the repository
// (e.g. Git submodule) and it is cloned at running workflow (due to a private repository).
return
}
if meta == nil {
return
}
rule.checkAction(meta, action, func(m *ActionMetadata) string {
return fmt.Sprintf("%q defined at %q", meta.Name, path)
})
}
func (rule *RuleAction) checkAction(meta *ActionMetadata, exec *ExecAction, describe func(*ActionMetadata) string) {
// Check specified inputs are defined in action's inputs spec
Outer:
for name, val := range exec.Inputs {
// XXX: This is O(n) workaround for #31
for n := range meta.Inputs {
// Input name is in lower case because parser.go converts all keys into lower case.
// But keys of ActionMetadata.Inputs are as-is defined in action.yml.
if strings.EqualFold(n, name) {
continue Outer // found
}
}
ns := make([]string, 0, len(meta.Inputs))
for n := range meta.Inputs {
ns = append(ns, n)
}
rule.errorf(
val.Name.Pos,
"input %q is not defined in action %s. available inputs are %s",
name,
describe(meta),
sortedQuotes(ns),
)
}
// Check mandatory inputs are specified
for name, required := range meta.Inputs {
if required {
if _, ok := exec.Inputs[strings.ToLower(name)]; !ok {
ns := make([]string, 0, len(meta.Inputs))
for n, req := range meta.Inputs {
if req {
ns = append(ns, n)
}
}
rule.errorf(
exec.Uses.Pos,
"missing input %q which is required by action %s. all required inputs are %s",
name,
describe(meta),
sortedQuotes(ns),
)
}
}
}
}