From 18fc0bc87879d34e93509c47f828ce54024f21a1 Mon Sep 17 00:00:00 2001 From: Mariell Hoversholm Date: Tue, 17 Jun 2025 21:15:03 +0200 Subject: [PATCH] Actions: Introduce Shellcheck action (#106843) --- .drone.yml | 42 +-------------------- .github/CODEOWNERS | 1 + .github/workflows/shellcheck.yml | 29 +++++++++++++++ scripts/drone/events/pr.star | 5 --- scripts/drone/pipelines/shellcheck.star | 49 ------------------------- scripts/drone/utils/images.star | 1 - scripts/publish-npm-packages.sh | 4 +- scripts/releasefinder.sh | 4 +- 8 files changed, 35 insertions(+), 100 deletions(-) create mode 100644 .github/workflows/shellcheck.yml delete mode 100644 scripts/drone/pipelines/shellcheck.star diff --git a/.drone.yml b/.drone.yml index 0cc37bfd8b0..a034e6c2294 100644 --- a/.drone.yml +++ b/.drone.yml @@ -1116,44 +1116,6 @@ volumes: clone: retries: 3 depends_on: [] -environment: - EDITION: oss -image_pull_secrets: -- gcr -- gar -kind: pipeline -name: pr-shellcheck -node: - type: no-parallel -platform: - arch: amd64 - os: linux -services: [] -steps: -- commands: - - apt-get update -yq && apt-get install shellcheck - - shellcheck -e SC1071 -e SC2162 scripts/**/*.sh - image: ubuntu:22.04 - name: shellcheck -trigger: - event: - - pull_request - paths: - exclude: - - '*.md' - - docs/** - - latest.json - include: - - scripts/**/*.sh -type: docker -volumes: -- host: - path: /var/run/docker.sock - name: docker ---- -clone: - retries: 3 -depends_on: [] image_pull_secrets: - gcr - gar @@ -4933,7 +4895,6 @@ steps: - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/docs-base:latest - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM cypress/included:14.3.2 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM jwilder/dockerize:0.6.1 - - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM koalaman/shellcheck:stable - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM rockylinux:9 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM scottyhardy/docker-wine:stable-9.0 - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM us-docker.pkg.dev/grafanalabs-global/docker-deployment-tools-prod/github-app-secret-writer:2024-11-05-v11688112090.1-83920c59 @@ -4971,7 +4932,6 @@ steps: - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/docs-base:latest - trivy --exit-code 1 --severity HIGH,CRITICAL cypress/included:14.3.2 - trivy --exit-code 1 --severity HIGH,CRITICAL jwilder/dockerize:0.6.1 - - trivy --exit-code 1 --severity HIGH,CRITICAL koalaman/shellcheck:stable - trivy --exit-code 1 --severity HIGH,CRITICAL rockylinux:9 - trivy --exit-code 1 --severity HIGH,CRITICAL scottyhardy/docker-wine:stable-9.0 - trivy --exit-code 1 --severity HIGH,CRITICAL us-docker.pkg.dev/grafanalabs-global/docker-deployment-tools-prod/github-app-secret-writer:2024-11-05-v11688112090.1-83920c59 @@ -5206,6 +5166,6 @@ kind: secret name: gcr_credentials --- kind: signature -hmac: 966984931a9ff91ef1d2a0dfb2ecee03c4c36c58a23f2a14e4126b1e64015204 +hmac: 3aac355a5391ddeb89373f25dbae8003fb89e5c2645a7e8456dbbc5b6be44db1 ... diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 4e4d29a0710..d496fa79a2b 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -839,6 +839,7 @@ embed.go @grafana/grafana-as-code /.github/workflows/trivy-scan.yml @grafana/grafana-backend-services-squad /.github/workflows/trufflehog.yml @Proximyst /.github/workflows/changelog.yml @zserge +/.github/workflows/shellcheck.yml @grafana/grafana-developer-enablement-squad /.github/workflows/release-build.yml @grafana/grafana-developer-enablement-squad /.github/actions/changelog @zserge /.github/workflows/pr-frontend-unit-tests.yml @grafana/grafana-frontend-platform diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml new file mode 100644 index 00000000000..c0159f448f3 --- /dev/null +++ b/.github/workflows/shellcheck.yml @@ -0,0 +1,29 @@ +name: Shellcheck + +on: + push: + branches: + - main + - release-* + pull_request: + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: {} + +jobs: + shellcheck: + name: Shellcheck scripts + runs-on: ubuntu-latest + permissions: + contents: read # clone the repository + + steps: + - name: Clone repository + uses: actions/checkout@v4 + with: + persist-credentials: false + - name: Run Shellcheck + run: find scripts/ -name '*.sh' -type f -exec shellcheck -e SC1071 -e SC2162 '{}' + diff --git a/scripts/drone/events/pr.star b/scripts/drone/events/pr.star index 3d83763fb34..90a2736ebf3 100644 --- a/scripts/drone/events/pr.star +++ b/scripts/drone/events/pr.star @@ -24,10 +24,6 @@ load( "scripts/drone/pipelines/lint_backend.star", "lint_backend_pipeline", ) -load( - "scripts/drone/pipelines/shellcheck.star", - "shellcheck_pipeline", -) load( "scripts/drone/pipelines/swagger_gen.star", "swagger_gen", @@ -136,7 +132,6 @@ def pr_pipelines(): prefix = ver_mode, ), docs_pipelines(ver_mode, trigger_docs_pr()), - shellcheck_pipeline(), swagger_gen( ver_mode, ), diff --git a/scripts/drone/pipelines/shellcheck.star b/scripts/drone/pipelines/shellcheck.star deleted file mode 100644 index 4b00a9314d9..00000000000 --- a/scripts/drone/pipelines/shellcheck.star +++ /dev/null @@ -1,49 +0,0 @@ -""" -This module returns a Drone step and pipeline for linting with shellcheck. -""" - -load( - "scripts/drone/utils/images.star", - "images", -) -load( - "scripts/drone/utils/utils.star", - "pipeline", -) - -trigger = { - "event": [ - "pull_request", - ], - "paths": { - "exclude": [ - "*.md", - "docs/**", - "latest.json", - ], - "include": ["scripts/**/*.sh"], - }, -} - -def shellcheck_step(): - return { - "name": "shellcheck", - "image": images["ubuntu"], - "commands": [ - "apt-get update -yq && apt-get install shellcheck", - "shellcheck -e SC1071 -e SC2162 scripts/**/*.sh", - ], - } - -def shellcheck_pipeline(): - environment = {"EDITION": "oss"} - steps = [ - shellcheck_step(), - ] - return pipeline( - name = "pr-shellcheck", - trigger = trigger, - services = [], - steps = steps, - environment = environment, - ) diff --git a/scripts/drone/utils/images.star b/scripts/drone/utils/images.star index 27f5cb30d47..d4f9b659922 100644 --- a/scripts/drone/utils/images.star +++ b/scripts/drone/utils/images.star @@ -33,7 +33,6 @@ images = { "docs": "grafana/docs-base:latest", "cypress": "cypress/included:14.3.2", "dockerize": "jwilder/dockerize:0.6.1", - "shellcheck": "koalaman/shellcheck:stable", "rocky": "rockylinux:9", "wine": "scottyhardy/docker-wine:stable-9.0", "github_app_secret_writer": "us-docker.pkg.dev/grafanalabs-global/docker-deployment-tools-prod/github-app-secret-writer:2024-11-05-v11688112090.1-83920c59", diff --git a/scripts/publish-npm-packages.sh b/scripts/publish-npm-packages.sh index 3b279e81905..98a799edefa 100755 --- a/scripts/publish-npm-packages.sh +++ b/scripts/publish-npm-packages.sh @@ -47,14 +47,14 @@ done # Check if any files in packages/grafana-e2e-selectors were changed. If so, add a 'modified' tag to the package CHANGES_COUNT=$(git diff HEAD~1..HEAD --name-only -- packages/grafana-e2e-selectors | awk 'END{print NR}') -if (( $CHANGES_COUNT > 0 )); then +if (( CHANGES_COUNT > 0 )); then # Wait a little bit to allow the package to be published to the registry sleep 5s regex_pattern="canary: ([0-9.-]+)" TAGS=$(npm dist-tag ls @grafana/e2e-selectors) if [[ $TAGS =~ $regex_pattern ]]; then echo "$CHANGES_COUNT file(s) in packages/grafana-e2e-selectors were changed. Adding 'modified' tag to @grafana/e2e-selectors@${BASH_REMATCH[1]}" - npm dist-tag add @grafana/e2e-selectors@${BASH_REMATCH[1]} modified + npm dist-tag add @grafana/e2e-selectors@"${BASH_REMATCH[1]}" modified fi fi diff --git a/scripts/releasefinder.sh b/scripts/releasefinder.sh index adc0b7809dd..fb5bb23a386 100755 --- a/scripts/releasefinder.sh +++ b/scripts/releasefinder.sh @@ -61,7 +61,7 @@ echo " Date: $(git log -1 --format="%ad" --date=iso "$COMMIT_HASH")" # Extract original PR number and create link PR_NUMBER=$(git log -1 --pretty=format:"%B" "$COMMIT_HASH" | grep -o '#[0-9]\+' | head -n1 | tr -d '#') -if [ ! -z "$PR_NUMBER" ]; then +if [ -n "$PR_NUMBER" ]; then # Extract PR title (first line of commit message) PR_TITLE=$(git log -1 --pretty=format:"%s" "$COMMIT_HASH") echo " PR: #$PR_NUMBER - $PR_TITLE" @@ -104,7 +104,7 @@ done if [ ${#direct_tags[@]} -gt 0 ] || [ ${#included_tags[@]} -gt 0 ]; then echo "This commit has been included in these PREVIOUS on-prem releases:" # Get all tags sorted - all_tags=($(printf "%s\n" "${direct_tags[@]}" "${included_tags[@]}" | sort -V)) + readarray -t all_tags < <(printf "%s\n" "${direct_tags[@]}" "${included_tags[@]}" | sort -V) # Get the first release first_release="${all_tags[0]}" # Print all tags with annotation for the first release