trailofbits-buttercup/.github/workflows/static-checks.yml

name: Static Checks

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  static-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
        with:
          enable-cache: true

      - name: Set up Python
        run: uv python install 3.13

      - name: Lint GitHub Actions
        run: |
          # Install actionlint
          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
          ./actionlint -color

      - name: Security audit GitHub Actions
        run: |
          # Run zizmor in an isolated environment using uvx
          uvx zizmor .github/workflows/

      - name: Check YAML files
        run: |
          python3 -c "
          import yaml
          from pathlib import Path
          # Docker Compose merge tags are valid in compose files but unknown to safe_load
          for _t in ('!reset', '!override'):
              yaml.SafeLoader.add_constructor(_t, lambda loader, node: None)
          for f in Path('.').rglob('*.yaml'):
              if 'deployment/k8s' not in str(f):
                  list(yaml.safe_load_all(f.read_text()))
          for f in Path('.').rglob('*.yml'):
              if 'deployment/k8s' not in str(f):
                  list(yaml.safe_load_all(f.read_text()))
          "

      - name: Check TOML files
        run: |
          python3 -c "
          import tomllib
          from pathlib import Path
          for f in Path('.').rglob('*.toml'):
              tomllib.load(f.open('rb'))
          "

      - name: Check JSON files
        run: |
          python3 -c "
          import json
          from pathlib import Path
          for f in Path('.').rglob('*.json'):
              json.load(f.open())
          "

      - name: Check for merge conflicts
        run: |
          # Match exact git merge conflict markers:
          # - <<<<<<< (followed by space, e.g., "<<<<<<< HEAD")
          # - ======= (exactly 7 equals at end of line)
          # - >>>>>>> (followed by space, e.g., ">>>>>>> branch-name")
          ! grep -rE '^(<{7} |>{7} |={7}$)' --include='*.py' --include='*.yaml' --include='*.yml' --include='*.toml' --include='*.json' . || exit 1

      - name: Lint shell scripts
        run: |
          shellcheck --version
          # Exclude external directories (node_data_storage contains cloned repos, external has vendored code)
          find . -name '*.sh' -type f \
            ! -path './.git/*' \
            ! -path '*/.venv/*' \
            ! -path './node_data_storage/*' \
            ! -path './external/*' \
            -print0 | xargs -0 shellcheck

      - name: Lint Dockerfiles
        run: |
          # Install hadolint
          curl -sL -o hadolint "https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64"
          chmod +x hadolint
          ./hadolint --version
          # Exclude external directories (node_data_storage contains cloned repos, external has vendored code)
          find . -name 'Dockerfile*' -type f \
            ! -path './.git/*' \
            ! -path './node_data_storage/*' \
            ! -path './external/*' \
            -print0 | xargs -0 ./hadolint