mirror of
https://github.com/lukaszraczylo/shared-actions.git
synced 2026-10-12 04:54:48 +00:00
lukaszraczylo
f9b22ef8d9
A release run used to fail at the GoReleaser step when a secret was empty, after the tests and the version job had finished. A new preflight action checks the required names, the .Env references in the GoReleaser config and push access to optional repositories. It lists every problem in one run. The release and release-cgo workflows run it in a first job, so a missing secret fails in seconds. The release-cgo workflow requires GORELEASER_PRO. The release workflow requires the secrets that the GoReleaser config references. Set the preflight input to false to skip the check. Set preflight-repos to check access to a Homebrew tap or helm-charts repository.
89 lines
3.4 KiB
YAML
89 lines
3.4 KiB
YAML
name: "Preflight"
|
|
description: "Fail early when a required secret, env var or repository access is missing"
|
|
|
|
inputs:
|
|
require:
|
|
description: "Comma-separated names that must be set and non-empty in the step env"
|
|
required: false
|
|
default: ""
|
|
goreleaser-scan:
|
|
description: "Also require every .Env.NAME referenced by the GoReleaser config"
|
|
required: false
|
|
default: "true"
|
|
repo-access:
|
|
description: "Comma-separated owner/repo list the token must have push access to"
|
|
required: false
|
|
default: ""
|
|
repo-token-env:
|
|
description: "Name of the env var that holds the token for repo-access"
|
|
required: false
|
|
default: "HOMEBREW_TAP_TOKEN"
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: Check prerequisites
|
|
shell: bash
|
|
env:
|
|
PF_REQUIRE: ${{ inputs.require }}
|
|
PF_SCAN: ${{ inputs.goreleaser-scan }}
|
|
PF_REPOS: ${{ inputs.repo-access }}
|
|
PF_TOKEN_ENV: ${{ inputs.repo-token-env }}
|
|
run: |
|
|
missing=()
|
|
add_missing() { # name reason
|
|
case " ${missing[*]-} " in *" $1 "*) return ;; esac
|
|
missing+=("$1")
|
|
echo "::error title=Missing $1::$2"
|
|
}
|
|
is_set() { [ -n "${!1:-}" ]; }
|
|
|
|
IFS=',' read -r -a required <<< "$PF_REQUIRE"
|
|
for name in "${required[@]-}"; do
|
|
name="${name// /}"
|
|
[ -z "$name" ] && continue
|
|
is_set "$name" || add_missing "$name" "Required by this workflow but empty. Set the repository or organisation secret $name and make sure the caller passes 'secrets: inherit'."
|
|
done
|
|
|
|
if [ "$PF_SCAN" = "true" ]; then
|
|
for cfg in .goreleaser.yaml .goreleaser.yml goreleaser.yaml goreleaser.yml; do
|
|
[ -f "$cfg" ] || continue
|
|
echo "Scanning $cfg for .Env references"
|
|
while IFS= read -r ref; do
|
|
name="${ref#.Env.}"
|
|
is_set "$name" || add_missing "$name" "$cfg references .Env.$name but it is not available to the GoReleaser step. GoReleaser would fail at the end of the run."
|
|
done < <(grep -vE '^[[:space:]]*#' "$cfg" | grep -oE '\.Env\.[A-Za-z_][A-Za-z0-9_]*' | sort -u)
|
|
break
|
|
done
|
|
fi
|
|
|
|
if [ -n "$PF_REPOS" ]; then
|
|
token="${!PF_TOKEN_ENV:-}"
|
|
if [ -z "$token" ]; then
|
|
add_missing "$PF_TOKEN_ENV" "repo-access needs this token but it is empty."
|
|
else
|
|
IFS=',' read -r -a repos <<< "$PF_REPOS"
|
|
for repo in "${repos[@]}"; do
|
|
repo="${repo// /}"
|
|
[ -z "$repo" ] && continue
|
|
body="$(mktemp)"
|
|
code="$(curl -sS -o "$body" -w '%{http_code}' \
|
|
-H "Authorization: Bearer $token" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
"${GITHUB_API_URL:-https://api.github.com}/repos/$repo")" || code="000"
|
|
if [ "$code" != "200" ]; then
|
|
add_missing "access:$repo" "$PF_TOKEN_ENV cannot read $repo (HTTP $code). Check the token scope, expiry and repository access."
|
|
elif ! grep -qE '"push": *true' "$body"; then
|
|
add_missing "access:$repo" "$PF_TOKEN_ENV can read $repo but has no push access."
|
|
fi
|
|
rm -f "$body"
|
|
done
|
|
fi
|
|
fi
|
|
|
|
if [ "${#missing[@]}" -gt 0 ]; then
|
|
echo "Preflight failed: ${missing[*]}"
|
|
exit 1
|
|
fi
|
|
echo "Preflight passed"
|