Actions: Introduce Shellcheck action (#106843)

2025-06-17 21:15:03 +02:00
parent 689cafc1fa
commit 18fc0bc878
8 changed files with 35 additions and 100 deletions
@@ -1116,44 +1116,6 @@ volumes:
 clone:
  retries: 3
 depends_on: []
-environment:
-  EDITION: oss
-image_pull_secrets:
- gcr
- gar
-kind: pipeline
-name: pr-shellcheck
-node:
-  type: no-parallel
-platform:
-  arch: amd64
-  os: linux
-services: []
-steps:
- commands:
-  - apt-get update -yq && apt-get install shellcheck
-  - shellcheck -e SC1071 -e SC2162 scripts/**/*.sh
-  image: ubuntu:22.04
-  name: shellcheck
-trigger:
-  event:
-  - pull_request
-  paths:
-    exclude:
-    - '*.md'
-    - docs/**
-    - latest.json
-    include:
-    - scripts/**/*.sh
-type: docker
-volumes:
- host:
-    path: /var/run/docker.sock
-  name: docker
---
-clone:
-  retries: 3
-depends_on: []
 image_pull_secrets:
 - gcr
 - gar
@@ -4933,7 +4895,6 @@ steps:
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/docs-base:latest
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM cypress/included:14.3.2
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM jwilder/dockerize:0.6.1
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM koalaman/shellcheck:stable
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM rockylinux:9
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM scottyhardy/docker-wine:stable-9.0
  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM us-docker.pkg.dev/grafanalabs-global/docker-deployment-tools-prod/github-app-secret-writer:2024-11-05-v11688112090.1-83920c59
@@ -4971,7 +4932,6 @@ steps:
  - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/docs-base:latest
  - trivy --exit-code 1 --severity HIGH,CRITICAL cypress/included:14.3.2
  - trivy --exit-code 1 --severity HIGH,CRITICAL jwilder/dockerize:0.6.1
-  - trivy --exit-code 1 --severity HIGH,CRITICAL koalaman/shellcheck:stable
  - trivy --exit-code 1 --severity HIGH,CRITICAL rockylinux:9
  - trivy --exit-code 1 --severity HIGH,CRITICAL scottyhardy/docker-wine:stable-9.0
  - trivy --exit-code 1 --severity HIGH,CRITICAL us-docker.pkg.dev/grafanalabs-global/docker-deployment-tools-prod/github-app-secret-writer:2024-11-05-v11688112090.1-83920c59
@@ -5206,6 +5166,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: 966984931a9ff91ef1d2a0dfb2ecee03c4c36c58a23f2a14e4126b1e64015204
+hmac: 3aac355a5391ddeb89373f25dbae8003fb89e5c2645a7e8456dbbc5b6be44db1

 ...
@@ -839,6 +839,7 @@ embed.go @grafana/grafana-as-code
 /.github/workflows/trivy-scan.yml @grafana/grafana-backend-services-squad
 /.github/workflows/trufflehog.yml @Proximyst
 /.github/workflows/changelog.yml @zserge
+/.github/workflows/shellcheck.yml @grafana/grafana-developer-enablement-squad
 /.github/workflows/release-build.yml  @grafana/grafana-developer-enablement-squad
 /.github/actions/changelog @zserge
 /.github/workflows/pr-frontend-unit-tests.yml @grafana/grafana-frontend-platform
@@ -0,0 +1,29 @@
+name: Shellcheck
+
+on:
+  push:
+    branches:
+      - main
+      - release-*
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  shellcheck:
+    name: Shellcheck scripts
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # clone the repository
+
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Run Shellcheck
+        run: find scripts/ -name '*.sh' -type f -exec shellcheck -e SC1071 -e SC2162 '{}' +
@@ -24,10 +24,6 @@ load(
    "scripts/drone/pipelines/lint_backend.star",
    "lint_backend_pipeline",
 )
-load(
-    "scripts/drone/pipelines/shellcheck.star",
-    "shellcheck_pipeline",
-)
 load(
    "scripts/drone/pipelines/swagger_gen.star",
    "swagger_gen",
@@ -136,7 +132,6 @@ def pr_pipelines():
            prefix = ver_mode,
        ),
        docs_pipelines(ver_mode, trigger_docs_pr()),
-        shellcheck_pipeline(),
        swagger_gen(
            ver_mode,
        ),
@@ -1,49 +0,0 @@
-"""
-This module returns a Drone step and pipeline for linting with shellcheck.
-"""
-
-load(
-    "scripts/drone/utils/images.star",
-    "images",
-)
-load(
-    "scripts/drone/utils/utils.star",
-    "pipeline",
-)
-
-trigger = {
-    "event": [
-        "pull_request",
-    ],
-    "paths": {
-        "exclude": [
-            "*.md",
-            "docs/**",
-            "latest.json",
-        ],
-        "include": ["scripts/**/*.sh"],
-    },
-}
-
-def shellcheck_step():
-    return {
-        "name": "shellcheck",
-        "image": images["ubuntu"],
-        "commands": [
-            "apt-get update -yq && apt-get install shellcheck",
-            "shellcheck -e SC1071 -e SC2162 scripts/**/*.sh",
-        ],
-    }
-
-def shellcheck_pipeline():
-    environment = {"EDITION": "oss"}
-    steps = [
-        shellcheck_step(),
-    ]
-    return pipeline(
-        name = "pr-shellcheck",
-        trigger = trigger,
-        services = [],
-        steps = steps,
-        environment = environment,
-    )
@@ -33,7 +33,6 @@ images = {
    "docs": "grafana/docs-base:latest",
    "cypress": "cypress/included:14.3.2",
    "dockerize": "jwilder/dockerize:0.6.1",
-    "shellcheck": "koalaman/shellcheck:stable",
    "rocky": "rockylinux:9",
    "wine": "scottyhardy/docker-wine:stable-9.0",
    "github_app_secret_writer": "us-docker.pkg.dev/grafanalabs-global/docker-deployment-tools-prod/github-app-secret-writer:2024-11-05-v11688112090.1-83920c59",
@@ -47,14 +47,14 @@ done

 # Check if any files in packages/grafana-e2e-selectors were changed. If so, add a 'modified' tag to the package
 CHANGES_COUNT=$(git diff HEAD~1..HEAD --name-only -- packages/grafana-e2e-selectors | awk 'END{print NR}')
-if (( $CHANGES_COUNT > 0 )); then
+if (( CHANGES_COUNT > 0 )); then
    # Wait a little bit to allow the package to be published to the registry
    sleep 5s
    regex_pattern="canary: ([0-9.-]+)"
    TAGS=$(npm dist-tag ls @grafana/e2e-selectors)
    if [[ $TAGS =~ $regex_pattern ]]; then
        echo "$CHANGES_COUNT file(s) in packages/grafana-e2e-selectors were changed. Adding 'modified' tag to @grafana/e2e-selectors@${BASH_REMATCH[1]}"
-        npm dist-tag add @grafana/e2e-selectors@${BASH_REMATCH[1]} modified
+        npm dist-tag add @grafana/e2e-selectors@"${BASH_REMATCH[1]}" modified
    fi
 fi

@@ -61,7 +61,7 @@ echo "  Date: $(git log -1 --format="%ad" --date=iso "$COMMIT_HASH")"

 # Extract original PR number and create link
 PR_NUMBER=$(git log -1 --pretty=format:"%B" "$COMMIT_HASH" | grep -o '#[0-9]\+' | head -n1 | tr -d '#')
-if [ ! -z "$PR_NUMBER" ]; then
+if [ -n "$PR_NUMBER" ]; then
    # Extract PR title (first line of commit message)
    PR_TITLE=$(git log -1 --pretty=format:"%s" "$COMMIT_HASH")
    echo "  PR: #$PR_NUMBER - $PR_TITLE"
@@ -104,7 +104,7 @@ done
 if [ ${#direct_tags[@]} -gt 0 ] || [ ${#included_tags[@]} -gt 0 ]; then
    echo "This commit has been included in these PREVIOUS on-prem releases:"
    # Get all tags sorted
-    all_tags=($(printf "%s\n" "${direct_tags[@]}" "${included_tags[@]}" | sort -V))
+    readarray -t all_tags < <(printf "%s\n" "${direct_tags[@]}" "${included_tags[@]}" | sort -V)
    # Get the first release
    first_release="${all_tags[0]}"
    # Print all tags with annotation for the first release