scripts/check-callers.mjs

Functions

Imports

It imports no other module of this repo. No module of this repo imports it.

Source

1#!/usr/bin/env node
2// The check a caller of this repository's reusable workflows runs on its own workflow files:
3//
4//   node check-callers.mjs .github/workflows/no-bloat.yml [more files]
5//
6// Every `uses:` that names this repository's reusable workflows must end in `@` and a full 40-character commit sha: a branch
7// or a tag moves under a caller without a reviewed change to the caller. `secrets: inherit` is refused too, so a reader can
8// see exactly which secrets the shared file receives.
9//
10// Exit 0 when every call is pinned, 1 when any is not, 2 when a file is unreadable or names no call at all.
11
12import { readFileSync } from "node:fs";
13import { pathToFileURL } from "node:url";
14
15// A quoted value is the same value to YAML, so a quote around it is read through.
16const SHARED = /^\s*uses:\s*["']?(?<repo>[\w.-]+)\/devkit\/\.github\/workflows\/(?<file>[\w.-]+)@(?<ref>[^\s"']+)/;
17
18/**
19 * @param {string} text
20 * @returns {{ line: number, problem: string }[]}
21 */
22export function callerProblems(text) {
23  /** @type {{ line: number, problem: string }[]} */
24  const problems = [];
25  const lines = text.replace(/\r\n/g, "\n").split("\n");
26  let calls = 0;
27  lines.forEach((raw, index) => {
28    const line = raw.replace(/\s+#.*$/, "");
29    const call = SHARED.exec(line);
30    if (call?.groups) {
31      calls += 1;
32      if (!/^[0-9a-f]{40}$/.test(call.groups.ref)) {
33        problems.push({ line: index + 1, problem: `pinned to "${call.groups.ref}", not a full 40-character commit sha` });
34      }
35    }
36    if (/^\s*secrets:\s*(["']?)inherit\1\s*$/.test(line)) {
37      problems.push({ line: index + 1, problem: "secrets: inherit hides what the shared workflow receives; pass each secret by name" });
38    }
39  });
40  if (calls === 0) problems.push({ line: 0, problem: "no call to a devkit reusable workflow" });
41  return problems;
42}
43
44if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
45  const files = process.argv.slice(2);
46  if (files.length === 0) {
47    console.error("usage: check-callers.mjs <workflow file>...");
48    process.exit(2);
49  }
50  let status = 0;
51  for (const file of files) {
52    let text;
53    try {
54      text = readFileSync(file, "utf8");
55    } catch (error) {
56      console.error(`${file}: cannot read: ${error instanceof Error ? error.message : error}`);
57      process.exit(2);
58    }
59    const problems = callerProblems(text);
60    for (const { line, problem } of problems) console.error(`${file}${line ? `:${line}` : ""}: ${problem}`);
61    if (problems.some((p) => p.line === 0)) status = Math.max(status, 2);
62    else if (problems.length > 0) status = Math.max(status, 1);
63    else console.log(`${file}: ok`);
64  }
65  process.exit(status);
66}