dotnet-template/.github/workflows/ci.yaml at main · devantler-tech/dotnet-template · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
---
name: CI

on:
  pull_request:
  merge_group:

permissions: {}

jobs:
  validate-retired-links:
    name: Validate retired repository links
    if: github.repository == 'devantler-tech/dotnet-template'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Check documentation
        id: links
        uses: devantler-tech/.github/actions/validate-retired-repo-links@8d2203af130a8c27b8b98b3d7146f76b5ade7a98 # v7.16.2
        with:
          enabled: "true"
      - name: Require a complete scan
        env:
          VALIDATED: ${{ steps.links.outputs.validated }}
        run: test "$VALIDATED" = true
      - name: Prepare an isolated retired-link fixture
        id: fixture
        shell: bash
        run: |
          set -euo pipefail
          fixture=$(mktemp -d "$RUNNER_TEMP/retired-link-fixture.XXXXXX")
          git archive HEAD | tar -x -C "$fixture"
          printf '\n[Retired-link fixture](https://github.com/devantler-tech/reusable-workflows)\n' >> "$fixture/README.md"
          echo "directory=$fixture" >> "$GITHUB_OUTPUT"
      - name: Reject the seeded retired link
        id: negative
        continue-on-error: true
        uses: devantler-tech/.github/actions/validate-retired-repo-links@8d2203af130a8c27b8b98b3d7146f76b5ade7a98 # v7.16.2
        with:
          enabled: "true"
          working-directory: ${{ steps.fixture.outputs.directory }}
      - name: Require the negative control to fail without success output
        if: always()
        env:
          OUTCOME: ${{ steps.negative.outcome }}
          VALIDATED: ${{ steps.negative.outputs.validated }}
        run: |
          test "$OUTCOME" = failure
          test -z "$VALIDATED"
      - name: Checkout the exact validator source for diagnostic verification
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: devantler-tech/.github
          ref: bd0035dd8f41fcf1459b878882b8897443f8dc59 # v4.9.4
          path: .catalogue-fixture
          sparse-checkout: actions/validate-retired-repo-links
          persist-credentials: false
      - name: Require the expected README finding
        shell: bash
        env:
          FIXTURE: ${{ steps.fixture.outputs.directory }}
          GOWORK: "off"
          GOFLAGS: ""
          GOTOOLCHAIN: local
        run: |
          set -euo pipefail
          go -C .catalogue-fixture/actions/validate-retired-repo-links build -mod=readonly -trimpath -o "$RUNNER_TEMP/retired-link-validator" .
          result=0
          "$RUNNER_TEMP/retired-link-validator" --root "$FIXTURE" > "$RUNNER_TEMP/retired-link-finding.log" 2>&1 || result=$?
          cat "$RUNNER_TEMP/retired-link-finding.log"
          test "$result" -eq 1
          grep -E '^README.md:[0-9]+: link targets retired repository devantler-tech/reusable-workflows$' "$RUNNER_TEMP/retired-link-finding.log"

  required-checks:
    name: CI - Required Checks
    needs: [validate-retired-links]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: ✅ Aggregate job checks
        uses: devantler-tech/.github/actions/aggregate-job-checks@8d2203af130a8c27b8b98b3d7146f76b5ade7a98 # v7.16.2
        with:
          job-results: ${{ needs.validate-retired-links.result }}