chore(deps): update metio ci #296
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: The jaas Authors | |
| # SPDX-License-Identifier: 0BSD | |
| name: Verify | |
| on: | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| go: | |
| # Reusable Go pipeline (build, race tests + envtest matrix, vet, staticcheck, | |
| # gosec, gofumpt, govulncheck, arch-go) shared across the metio Go repos. The | |
| # detect job auto-enables envtest and arch-go from this repo's files. Named | |
| # "Golang" so its checks read "Golang / test", "Golang / lint", … | |
| name: Golang | |
| uses: metio/ci/.github/workflows/golang.yml@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806 | |
| reuse: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: metio/nix-devshell@1976169d4c51b321be318ade369ccf689849f9f0 # 2026.7.6091757 | |
| - run: nix develop --command reuse lint | |
| yaml: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: metio/nix-devshell@1976169d4c51b321be318ade369ccf689849f9f0 # 2026.7.6091757 | |
| - run: nix develop --command yamllint . | |
| github-actions: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: metio/nix-devshell@1976169d4c51b321be318ade369ccf689849f9f0 # 2026.7.6091757 | |
| # shellcheck rides in the devShell, so actionlint lints run: blocks too. | |
| - run: nix develop --command actionlint | |
| markdown: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: metio/nix-devshell@1976169d4c51b321be318ade369ccf689849f9f0 # 2026.7.6091757 | |
| - run: nix develop --command markdownlint-cli2 "**/*.md" | |
| typos: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: metio/nix-devshell@1976169d4c51b321be318ade369ccf689849f9f0 # 2026.7.6091757 | |
| - run: nix develop --command typos | |
| generated: | |
| # controller-gen's output is committed (api/v1/zz_generated.deepcopy.go, the | |
| # CRDs under config/crd/bases), and nothing else re-runs the generators — so | |
| # a change to api/v1 that forgets to regenerate ships CRDs that contradict | |
| # the types, and no other gate notices. Regenerate and fail on any diff. | |
| # | |
| # The check is scoped to the generated paths so an unrelated dirty file (a | |
| # submodule, a build artifact) can't masquerade as drift. | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: metio/nix-devshell@1976169d4c51b321be318ade369ccf689849f9f0 # 2026.7.6091757 | |
| - run: nix develop --command generate | |
| - name: Fail on stale generated files | |
| run: | | |
| drift=$(git status --porcelain -- api config) | |
| if [ -n "$drift" ]; then | |
| echo "::error::Generated files are stale. Run 'nix develop --command generate' and commit the result." | |
| echo "$drift" | |
| git --no-pager diff -- api config | |
| exit 1 | |
| fi | |
| prose: | |
| # Vale prose lint against the shared metio/vale-config style; .vale.ini pulls | |
| # the published package. Fails on error-level findings (naming/branding); | |
| # inclusive-language findings are warning-level and only annotate. | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: vale-cli/vale-action@85f9f7f2c5f449ac0ae5b66662961bae3f77ca6a # 2.1.2 # renovate: pin to a SHA | |
| with: | |
| files: docs/content | |
| fail_on_error: true | |
| docs-lint: | |
| # Build the site and lint the rendered HTML (htmltest: dead internal links, | |
| # missing alt text, broken anchors) plus the theme CSS (biome). All tools | |
| # (hugo, helm-schema, htmltest, biome, go) come from the flake devShell. | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| submodules: recursive | |
| - uses: metio/nix-devshell@1976169d4c51b321be318ade369ccf689849f9f0 # 2026.7.6091757 | |
| - name: Generate docs data (flags + chart values) | |
| run: nix develop --command hack/gen-docs-data.sh | |
| - name: Build Website | |
| run: nix develop --command hugo --minify --source docs | |
| - name: Lint rendered HTML (htmltest) | |
| run: nix develop --command htmltest | |
| - name: Lint theme CSS (biome) | |
| # Run from inside the theme dir with no path argument: biome v2 treats a | |
| # biome.json as a project root, so invoking from the repo root flags the | |
| # theme config as a root nested under the repo-root project. From the | |
| # theme dir its biome.json is the sole root, and omitting the path lets | |
| # files.includes scope the run to the authored CSS (a path argument would | |
| # override the config and pull in the vendored normalize.css/syntax.css). | |
| run: nix develop --command bash -c 'cd docs/themes/metio && biome lint' | |
| container-image: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - id: buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 | |
| - id: image | |
| name: Build image | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| builder: ${{ steps.buildx.outputs.name }} | |
| context: . | |
| file: ./Dockerfile | |
| push: false | |
| load: true | |
| tags: ghcr.io/metio/jaas:${{ github.sha }} | |
| - name: Scan image (Trivy) | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: ghcr.io/metio/jaas:${{ github.sha }} | |
| format: table | |
| # Hard gate on any fixable CRITICAL/HIGH in the distroless image: | |
| # the base is slim and patched, so findings are rare and worth | |
| # investigating before merge. | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| dco: | |
| # Developer Certificate of Origin: every commit must carry a Signed-off-by | |
| # trailer. Skipped for bot-authored PRs (Renovate/Dependabot cannot sign off); | |
| # a skipped job still satisfies the all-green gate below. | |
| if: github.event.pull_request.user.type != 'Bot' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: metio/ci/dco@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # main | |
| policy: | |
| # metio org workflow conventions (conftest/Rego from metio/ci): SHA-pinned | |
| # uses refs, top-level permissions, timeout-minutes on every job, no | |
| # untrusted ${{ github.event.* }} interpolation in run: blocks. | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: metio/ci/policy-check@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806 | |
| verify: | |
| # Single required check covering every job above: mark only this one | |
| # required in branch protection and new jobs are covered automatically. | |
| name: Verify | |
| needs: [go, reuse, yaml, github-actions, markdown, typos, generated, prose, docs-lint, container-image, dco, policy] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Verify every job succeeded or skipped | |
| env: | |
| NEEDS: ${{ toJSON(needs) }} | |
| run: | | |
| bad=$(echo "$NEEDS" | jq -r 'to_entries[] | select(.value.result != "success" and .value.result != "skipped") | "\(.key)=\(.value.result)"') | |
| [ -z "$bad" ] || { echo "::error::$bad"; exit 1; } |