This repository was archived by the owner on Jul 8, 2026. It is now read-only.
Security: Fix 52 Dependabot vulnerabilities + Block Rules API + Media Streaming Expansion #54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Lint and Format | |
| on: | |
| push: | |
| branches: [main, develop, 'feature/*', 'release/*'] | |
| paths: | |
| - 'manager/**' | |
| - 'proxy-egress/**' | |
| - 'proxy-ingress/**' | |
| - 'proxy-ailb/**' | |
| - 'proxy-alb/**' | |
| - 'proxy-dblb/**' | |
| - 'proxy-l3l4/**' | |
| - 'proxy-l7/**' | |
| - 'proxy-nlb/**' | |
| - 'proxy-rtmp/**' | |
| - '.version' | |
| - '.github/workflows/lint-and-format.yml' | |
| pull_request: | |
| branches: [main, develop] | |
| paths: | |
| - 'manager/**' | |
| - 'proxy-egress/**' | |
| - 'proxy-ingress/**' | |
| - 'proxy-ailb/**' | |
| - 'proxy-alb/**' | |
| - 'proxy-dblb/**' | |
| - 'proxy-l3l4/**' | |
| - 'proxy-l7/**' | |
| - 'proxy-nlb/**' | |
| - 'proxy-rtmp/**' | |
| - '.version' | |
| workflow_dispatch: | |
| jobs: | |
| # Python linting and formatting | |
| python-lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Cache Python packages | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.cache/pip | |
| key: ${{ runner.os }}-pip-lint-${{ hashFiles('**/requirements.txt') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pip- | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install black flake8 mypy isort bandit safety | |
| - name: Run Black (code formatting) | |
| continue-on-error: true | |
| run: | | |
| git diff --name-only --diff-filter=ACM origin/main...HEAD | \ | |
| grep '\.py$' | xargs -r black --check --diff || true | |
| - name: Run flake8 (linting) | |
| continue-on-error: true | |
| run: | | |
| git diff --name-only --diff-filter=ACM origin/main...HEAD | \ | |
| grep '\.py$' | xargs -r flake8 --max-line-length=100 \ | |
| --extend-ignore=E203,W503,C901,E712 || true | |
| - name: Run bandit (security linting) | |
| continue-on-error: true | |
| run: | | |
| bandit -r manager/apps/ -f json -o bandit-report.json || true | |
| bandit -r manager/apps/ || true | |
| - name: Run safety (dependency security check) | |
| continue-on-error: true | |
| run: | | |
| safety check || true | |
| # Go linting and formatting | |
| go-lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.24' | |
| - name: Cache Go modules | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cache/go-build | |
| ~/go/pkg/mod | |
| key: ${{ runner.os }}-go-lint-${{ hashFiles('**/go.sum') }} | |
| restore-keys: | | |
| ${{ runner.os }}-go- | |
| - name: Install golangci-lint | |
| run: | | |
| curl -sSfL \ | |
| https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | \ | |
| sh -s -- -b $(go env GOPATH)/bin v1.62.2 | |
| - name: Run golangci-lint on changed Go files | |
| continue-on-error: true | |
| run: | | |
| changed_files=$(git diff --name-only --diff-filter=ACM \ | |
| origin/main...HEAD | grep '\.go$' || true) | |
| if [ -n "$changed_files" ]; then | |
| for dir in proxy-egress proxy-ingress proxy-l3l4 proxy-alb proxy-rtmp; do | |
| if echo "$changed_files" | grep -q "^$dir/"; then | |
| echo "Linting $dir..." | |
| cd $dir | |
| $(go env GOPATH)/bin/golangci-lint run \ | |
| --timeout=5m --new-from-rev=origin/main || true | |
| cd .. | |
| fi | |
| done | |
| else | |
| echo "No Go files changed, skipping golangci-lint" | |
| fi | |
| - name: Check go fmt on changed files | |
| continue-on-error: true | |
| run: | | |
| git diff --name-only --diff-filter=ACM origin/main...HEAD | \ | |
| grep '\.go$' | xargs -r gofmt -l || true | |
| # Docker linting | |
| docker-lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Run Hadolint on Manager Dockerfile | |
| uses: hadolint/hadolint-action@v3.1.0 | |
| continue-on-error: true | |
| with: | |
| dockerfile: manager/Dockerfile | |
| format: sarif | |
| output-file: hadolint-manager.sarif | |
| no-fail: true | |
| config: .hadolint.yaml | |
| - name: Run Hadolint on Proxy Egress Dockerfile | |
| uses: hadolint/hadolint-action@v3.1.0 | |
| continue-on-error: true | |
| with: | |
| dockerfile: proxy-egress/Dockerfile | |
| format: sarif | |
| output-file: hadolint-proxy-egress.sarif | |
| no-fail: true | |
| config: .hadolint.yaml | |
| - name: Run Hadolint on Proxy Ingress Dockerfile | |
| uses: hadolint/hadolint-action@v3.1.0 | |
| continue-on-error: true | |
| with: | |
| dockerfile: proxy-ingress/Dockerfile | |
| format: sarif | |
| output-file: hadolint-proxy-ingress.sarif | |
| no-fail: true | |
| config: .hadolint.yaml | |
| - name: Upload Hadolint SARIF files | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| continue-on-error: true | |
| with: | |
| sarif_file: . | |
| category: hadolint | |
| # Shell script linting | |
| shell-lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Run ShellCheck | |
| uses: ludeeus/action-shellcheck@master | |
| continue-on-error: true | |
| with: | |
| scandir: './scripts' | |
| format: gcc | |
| severity: warning | |
| # YAML linting | |
| yaml-lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Run yamllint | |
| uses: ibiqlik/action-yamllint@v3 | |
| continue-on-error: true | |
| with: | |
| config_file: .yamllint.yaml | |
| format: parsable | |
| file_or_dir: | | |
| .github/workflows/ | |
| docker-compose.yml | |
| docker-compose.ci.yml |