code-quality.yaml

---
name: Code static analysis
on:  # yamllint disable-line rule:truthy
  push:
    branches: [main, stable, 'rhoai-*']
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  check-generated-code:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - name: Setup uv and Python
        uses: ./.github/actions/setup-uv

      - name: Rerun all code generators we have
        run: bash ci/generate_code.sh

      - name: Check there aren't any modified files present
        run: |
          clean=$(git status --porcelain)
          if [[ -z "$clean" ]]; then
              echo "Empty git status --porcelain: $clean"
          else
              echo "::error::Please run 'bash ci/generate_code.sh' (the command from the previous step), commit the changed files locally, and push again."
              echo "Uncommitted file changes detected: $clean"
              git diff
              exit 1
          fi

  pytest-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          # Full history so tests/test_pylock_downgrade.py can `git show origin/main:…/pylock.toml`.
          fetch-depth: 0

      - name: Setup uv and Python
        uses: ./.github/actions/setup-uv

      - name: Check uv is installed correctly
        run: uv version

      - name: Install deps
        id: install-deps
        run: uv sync --locked

      - name: Static tests (pytest + Dockerfile alignment)
        run: make test
        if: ${{ steps.install-deps.conclusion == 'success' && !cancelled() }}
        env:
          # PR: compare to the PR base (fork PRs vs upstream main, not the fork default branch).
          # Push: compare to the previous tip of this branch (not origin/main on stable/rhoai-*).
          NOTEBOOKS_DOWNGRADE_BASE_REF: ${{ github.event.pull_request.base.sha || github.event.before }}

      - name: Upload Python coverage to Codecov
        if: ${{ !cancelled() && steps.install-deps.conclusion == 'success' }}
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: opendatahub-io/notebooks
          files: coverage.xml
          flags: python
          fail_ci_if_error: false

      - name: Upload test results to Codecov
        if: ${{ !cancelled() && steps.install-deps.conclusion == 'success' }}
        uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3  # v1.2.1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  go-tests:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version-file: scripts/buildinputs/go.mod

      - name: golangci-lint
        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20  # v9.2.0
        with:
          version: v2.12.2
          working-directory: scripts/buildinputs

      - name: Install gotestsum
        run: go install gotest.tools/gotestsum@v1.13.0

      - name: Run Go tests with coverage and JUnit output
        run: gotestsum --junitfile=junit-go.xml -- -coverprofile=coverage-go.out -covermode=atomic ./...
        working-directory: scripts/buildinputs

      - name: Upload Go coverage to Codecov
        if: ${{ !cancelled() }}
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: opendatahub-io/notebooks
          files: scripts/buildinputs/coverage-go.out
          flags: go
          fail_ci_if_error: false

      - name: Upload Go test results to Codecov
        if: ${{ !cancelled() }}
        uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3  # v1.2.1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: scripts/buildinputs/junit-go.xml

  code-static-analysis:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - name: Do not check secrets, they are encrypted
        run: rm -rf ./ci/secrets

      - name: Install linting tools
        uses: ./.github/actions/apt-install
        with:
          packages: yamllint yajl-tools wget

      - name: Validate YAML files (best code practices check included)
        if: ${{ !cancelled() }}
        id: validate-yaml-files
        run: |
          # We ignore .tekton (managed by devops), insta-merge.yaml, and machine-generated .lock.yaml lockfiles
          # (e.g. rpms.lock.yaml, artifacts.lock.yaml — produced by rpm-lockfile-prototype with non-configurable indentation).
          find . -name "*.yaml" | grep -v "./.tekton/" | grep -v "./.github/workflows/insta-merge.yaml" | grep -v "\.lock\.yaml$" | xargs yamllint --strict --config-file ./ci/yamllint-config.yaml
          find . -name "*.yml" | grep -v "./.tekton/" | xargs yamllint --strict --config-file ./ci/yamllint-config.yaml

      # In some YAML files we use JSON strings, let's check these
      - name: Validate JSON strings in YAML files (just syntax)
        if: ${{ !cancelled() }}
        id: validate-json-strings-in-yaml-files
        run: |
          bash ./ci/check-json.sh

      - name: Validate JSON files (just syntax)
        if: ${{ !cancelled() }}
        id: validate-json-files
        run: ./ci/validate_json.py

      - name: Validate Dockerfiles
        if: ${{ !cancelled() }}
        id: validate-dockerfiles
        run: |
          wget --output-document=hadolint https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64
          chmod a+x hadolint
          echo "Starting Hadolint"
          find . -name "Dockerfile*" | xargs ./hadolint --config ./ci/hadolint-config.yaml
          echo "Hadolint done"

      # This simply checks that the manifests and respective kustomization.yaml finishes without an error.
      - name: Check kustomize manifest
        if: ${{ !cancelled() }}
        id: kustomize-manifests
        run: ./ci/kustomize.sh

  # https://github.com/pre-commit/action
  prek:
    name: "prek"
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup-uv
      - name: "Cache prek"
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
        with:
          path: ~/.cache/prek
          key: prek-${{ hashFiles('.pre-commit-config.yaml') }}
      # https://github.com/astral-sh/ruff/blob/3bfdb1208392802d3b38ec771789a99437c482d0/.github/workflows/ci.yaml#L810
      - name: "Run prek"
        run: |
          echo '```console' > "$GITHUB_STEP_SUMMARY"
          # Enable color output for prek and remove it for the summary
          # Use --hook-stage=manual to enable slower hooks that are skipped by default
          uvx prek run --all-files --show-diff-on-failure --color always --hook-stage manual | \
            tee >(sed -E 's/\x1B\[([0-9]{1,2}(;[0-9]{1,2})*)?[mGK]//g' >> "$GITHUB_STEP_SUMMARY") >&1
          exit_code="${PIPESTATUS[0]}"
          echo '```' >> "$GITHUB_STEP_SUMMARY"
          exit "$exit_code"

  action-pin-check:
    name: GitHub Actions SHA pinning
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      PINACT_VERSION: "3.9.0"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false
      - name: Install pinact
        run: |
          curl -sL "https://github.com/suzuki-shunsuke/pinact/releases/download/v${PINACT_VERSION}/pinact_linux_amd64.tar.gz" \
            | tar xz -C /usr/local/bin
      - name: Check all actions are SHA-pinned
        run: pinact run --check
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Verify SHAs match version comments
        # aquasecurity org has an IP allowlist that blocks GHA runners
        run: pinact run --verify --exclude '^aquasecurity/trivy-action$'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}