From 3dde77ffa380f351f9e1694146d4d06c5a907a0d Mon Sep 17 00:00:00 2001 From: Stafford Williams Date: Thu, 8 Oct 2026 13:43:22 +1100 Subject: [PATCH 1/3] feat: add native github-actions check --- .oxfmtrc.json | 2 +- README.md | 24 +- package-lock.json | 16 +- package.json | 6 +- schemas/LICENSE | 202 +++ schemas/README.md | 20 + schemas/github-action.json | 718 +++++++++ schemas/github-workflow.json | 2308 ++++++++++++++++++++++++++++ scripts/refresh-github-schemas.mjs | 23 + src/checks/github-actions.test.ts | 205 +++ src/checks/github-actions.ts | 90 ++ src/checks/githubActionsSchema.ts | 66 + src/checks/githubPathFilter.ts | 67 + src/checks/registry.test.ts | 5 + src/checks/registry.ts | 2 + src/checks/schemaErrorSelection.ts | 133 ++ src/commands/registerChecks.ts | 8 + src/index.ts | 1 + src/shared/yamlLocation.ts | 56 + 19 files changed, 3941 insertions(+), 11 deletions(-) create mode 100644 schemas/LICENSE create mode 100644 schemas/README.md create mode 100644 schemas/github-action.json create mode 100644 schemas/github-workflow.json create mode 100644 scripts/refresh-github-schemas.mjs create mode 100644 src/checks/github-actions.test.ts create mode 100644 src/checks/github-actions.ts create mode 100644 src/checks/githubActionsSchema.ts create mode 100644 src/checks/githubPathFilter.ts create mode 100644 src/checks/schemaErrorSelection.ts create mode 100644 src/shared/yamlLocation.ts diff --git a/.oxfmtrc.json b/.oxfmtrc.json index 4152a1d..744f976 100644 --- a/.oxfmtrc.json +++ b/.oxfmtrc.json @@ -12,5 +12,5 @@ "bracketSameLine": false, "bracketSpacing": true, "sortImports": true, - "ignorePatterns": ["**/dist/**", "**/coverage/**", "**/CHANGELOG.md"] + "ignorePatterns": ["**/dist/**", "**/coverage/**", "**/CHANGELOG.md", "schemas/*.json"] } diff --git a/README.md b/README.md index 4807c81..e90cce6 100644 --- a/README.md +++ b/README.md @@ -120,6 +120,7 @@ Flags on the bare `verifyx` command: | `comments` | native | Flags comment blocks taller than `--max-lines` (default 2), to push for self-documenting code. JSDoc and `context:`-prefixed blocks are always allowed. Add `--block-new-comments` to also fail any comment on a changed line (vs `HEAD` locally, the PR base in CI). | | `hardcoded-colors` | native | Literal hex / `0x` colour values in source (cross-platform; suggests using design tokens). | | `forbidden-strings` | native | Disallowed JSON config values, from rules in your verify config. | +| `github-actions` | native | Schema-validates GitHub Actions workflows (`.github/workflows/*.yml`) and action metadata (`.github/actions/**/action.yml`, root `action.yml`) against vendored SchemaStore schemas, e.g. `timeout-minutes` on a composite action step, and fails trigger `paths`/`paths-ignore` globs that match no file. Skips when there are none. | | `lint` | external | Linting; auto-fixes locally, checks in CI ([oxlint](https://oxc.rs)). | | `format` | external | Formatting; writes locally, checks in CI ([oxfmt](https://oxc.rs)). | | `check-types` | external | TypeScript type check (`tsc --noEmit`, or `tsc -b` when `tsconfig.json` has `references`); skips when there is no `tsconfig.json`. In build mode it fails up front if any config in the reference graph would write output next to its sources (set `noEmit` or an `outDir`). `tsc -b` still writes `.tsbuildinfo` files; point `tsBuildInfoFile` at `node_modules/.tmp` to keep them out of the tree. | @@ -231,6 +232,25 @@ Fails when a configured JSON value matches a disallowed glob, handy for catching } ``` +### `github-actions` + +```sh +verifyx github-actions +``` + +Catches workflow and action syntax errors before GitHub does. A key that isn't valid where it's used (such as `timeout-minutes` on a composite action step) stops the runner loading the action, and nothing else flags it until a run fails. It is recommended, so `verifyx init` preselects it and `verifyx all` runs it. + +- **Files**: `.github/workflows/*.{yml,yaml}` are validated as workflows; `.github/actions/**/action.{yml,yaml}` and a root `action.{yml,yaml}` as action metadata. With none of these, the check reports skipped. +- **Schemas**: the SchemaStore [`github-workflow`](https://json.schemastore.org/github-workflow.json) and [`github-action`](https://json.schemastore.org/github-action.json) schemas (Apache-2.0), vendored into the package under `schemas/`. Validation is pure JavaScript ([ajv](https://ajv.js.org) and [yaml](https://eemeli.org/yaml/)), cross-platform and makes no network requests. +- **Path filters**: each `paths` / `paths-ignore` glob under `on.push`, `on.pull_request` and `on.pull_request_target` must match at least one file in the repository (`git ls-files`, plus untracked files that aren't ignored), so a typo'd filter fails instead of silently never firing. Globs use GitHub's [filter pattern](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#filter-pattern-cheat-sheet) semantics: `*` doesn't cross `/`, `**` does, `?` and `+` quantify the preceding character, and a bare directory such as `docs` matches no files (use `docs/**`). A `!` negated glob must exclude at least one file the earlier globs matched. Globs containing `${{` are skipped, as is this part of the check outside a git repository. +- **Output**: each problem prints `file:line:col`, the path in the document, the message and the schema rule that failed. Where the schema allows alternatives (a job is either a normal or a reusable-workflow job), the errors come from the alternative the file most likely meant, not from every alternative. + +``` +.github/actions/setup/action.yml:10:7 runs.steps[1]: unexpected key "timeout-minutes" (#/properties/steps/items/additionalProperties) +``` + +The schemas follow GitHub's documented syntax, which is sometimes stricter than the runner. For example, a `workflow_dispatch` input must declare its `type`. + ## Scaffolding a project ### `verifyx init` @@ -332,7 +352,7 @@ const lint = await getCheck('lint')?.runDefault() const unused = await getCheck('unused-code')?.runDefault({ maxWarnings: 5 }) ``` -Native checks also expose a direct runner (`runComplexity`, `runComments`, `runHardcodedColors`, `runForbiddenStrings`); external checks (`lint`, `format`, `check-types`, `unused-code`, `circular-deps`, `duplicate-code`) have no standalone function and are run via the registry (`getCheck(name)?.runDefault()`) or the orchestrators. +Native checks also expose a direct runner (`runComplexity`, `runComments`, `runHardcodedColors`, `runForbiddenStrings`, `runGithubActions`); external checks (`lint`, `format`, `check-types`, `unused-code`, `circular-deps`, `duplicate-code`) have no standalone function and are run via the registry (`getCheck(name)?.runDefault()`) or the orchestrators. Entry points: @@ -345,6 +365,8 @@ Entry points: The `verify` runner, `comments`, `hardcoded-colors`, and `forbidden-strings` checks are ported from [staff0rd/assist](https://github.com/staff0rd/assist); the maintainability metrics originate there too. See [Steering the Vibe: Verify](https://staffordwilliams.com/blog/2025/12/14/steering-the-vibe-verify/) and [Complexity](https://staffordwilliams.com/blog/2026/02/22/steering-the-vibe-complexity/). +The `github-actions` check validates against JSON schemas from [SchemaStore](https://github.com/SchemaStore/schemastore), vendored in `schemas/` under the Apache License 2.0 (see `schemas/README.md`). + ## License MIT diff --git a/package-lock.json b/package-lock.json index f199f16..0982290 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,12 +9,14 @@ "version": "1.2.0", "license": "MIT", "dependencies": { + "ajv": "^8.20.0", "commander": "^15.0.0", "cross-spawn": "^7.0.6", "enquirer": "^2.4.1", "minimatch": "^10.2.5", "typescript": "^6.0.3", - "unbash": "^4.0.2" + "unbash": "^4.0.2", + "yaml": "^2.9.1" }, "bin": { "verifyx": "dist/cli.mjs" @@ -3032,7 +3034,8 @@ }, "node_modules/ajv": { "version": "8.20.0", - "dev": true, + "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz", + "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==", "license": "MIT", "dependencies": { "fast-deep-equal": "^3.1.3", @@ -3743,14 +3746,12 @@ }, "node_modules/fast-deep-equal": { "version": "3.1.3", - "dev": true, "license": "MIT" }, "node_modules/fast-uri": { "version": "3.1.8", "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", - "dev": true, "funding": [ { "type": "github", @@ -4231,7 +4232,6 @@ }, "node_modules/json-schema-traverse": { "version": "1.0.0", - "dev": true, "license": "MIT" }, "node_modules/json5": { @@ -5263,7 +5263,6 @@ }, "node_modules/require-from-string": { "version": "2.0.2", - "dev": true, "license": "MIT", "engines": { "node": ">=0.10.0" @@ -6107,8 +6106,9 @@ } }, "node_modules/yaml": { - "version": "2.9.0", - "dev": true, + "version": "2.9.1", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz", + "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==", "license": "ISC", "bin": { "yaml": "bin.mjs" diff --git a/package.json b/package.json index 8c850bb..82dabd1 100644 --- a/package.json +++ b/package.json @@ -29,6 +29,7 @@ }, "files": [ "dist", + "schemas", "templates" ], "type": "module", @@ -54,15 +55,18 @@ "test:watch": "vitest", "test:ci": "vitest run --reporter=default --reporter=junit --outputFile=test-results.xml", "audit": "better-npm-audit audit", + "schemas:refresh": "node scripts/refresh-github-schemas.mjs", "prepublishOnly": "npm run build" }, "dependencies": { + "ajv": "^8.20.0", "commander": "^15.0.0", "cross-spawn": "^7.0.6", "enquirer": "^2.4.1", "minimatch": "^10.2.5", "typescript": "^6.0.3", - "unbash": "^4.0.2" + "unbash": "^4.0.2", + "yaml": "^2.9.1" }, "devDependencies": { "@rollup/plugin-typescript": "^12.3.0", diff --git a/schemas/LICENSE b/schemas/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/schemas/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/schemas/README.md b/schemas/README.md new file mode 100644 index 0000000..2f2fc09 --- /dev/null +++ b/schemas/README.md @@ -0,0 +1,20 @@ +# Vendored JSON schemas + +The `github-actions` check validates against these schemas offline. They are copied verbatim from [SchemaStore](https://github.com/SchemaStore/schemastore) and are not modified. + +| File | Source | +| ---------------------- | ------------------------------------------------- | +| `github-workflow.json` | https://json.schemastore.org/github-workflow.json | +| `github-action.json` | https://json.schemastore.org/github-action.json | + +## Licence + +SchemaStore is licensed under the [Apache License 2.0](./LICENSE) (copied from https://github.com/SchemaStore/schemastore/blob/master/LICENSE). The rest of `@makerx/verify` is MIT. + +## Refreshing + +```sh +npm run schemas:refresh +``` + +This re-downloads both schemas and the licence. Review the diff, then run `npm run verify` and the tests. diff --git a/schemas/github-action.json b/schemas/github-action.json new file mode 100644 index 0000000..83068c4 --- /dev/null +++ b/schemas/github-action.json @@ -0,0 +1,718 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "$id": "https://json.schemastore.org/github-action.json", + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions", + "additionalProperties": false, + "definitions": { + "expressionSyntax": { + "$comment": "escape `{` and `}` in pattern to be unicode compatible (#1360)", + "type": "string", + "pattern": "^\\$\\{\\{(.|[\r\n])*\\}\\}$" + }, + "stringContainingExpressionSyntax": { + "$comment": "escape `{` and `}` in pattern to be unicode compatible (#1360)", + "type": "string", + "pattern": "^.*\\$\\{\\{(.|[\r\n])*\\}\\}.*$" + }, + "pre-if": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runspre-if", + "description": "Allows you to define conditions for the `pre:` action execution. The `pre:` action will only run if the conditions in `pre-if` are met. If not set, then `pre-if` defaults to `always()`. Note that the `step` context is unavailable, as no steps have run yet.", + "type": "string" + }, + "post-if": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runspost-if", + "description": "Allows you to define conditions for the `post:` action execution. The `post:` action will only run if the conditions in `post-if` are met. If not set, then `post-if` defaults to `always()`.", + "type": "string" + }, + "runs-javascript": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions", + "description": "Configures the path to the action's code and the application used to execute the code.", + "type": "object", + "properties": { + "using": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsusing", + "description": "The application used to execute the code specified in `main`.", + "enum": ["node12", "node16", "node20", "node24"] + }, + "main": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsmain", + "description": "The file that contains your action code. The application specified in `using` executes this file.", + "type": "string" + }, + "pre": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runspre", + "description": "Allows you to run a script at the start of a job, before the `main:` action begins. For example, you can use `pre:` to run a prerequisite setup script. The application specified with the `using` syntax will execute this file. The `pre:` action always runs by default but you can override this using `pre-if`.", + "type": "string" + }, + "pre-if": { + "$ref": "#/definitions/pre-if" + }, + "post": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runspost", + "description": "Allows you to run a script at the end of a job, once the `main:` action has completed. For example, you can use `post:` to terminate certain processes or remove unneeded files. The application specified with the `using` syntax will execute this file. The `post:` action always runs by default but you can override this using `post-if`.", + "type": "string" + }, + "post-if": { + "$ref": "#/definitions/post-if" + } + }, + "required": ["using", "main"], + "additionalProperties": false + }, + "runs-composite": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-composite-actions", + "description": "Configures the path to the composite action, and the application used to execute the code.", + "type": "object", + "properties": { + "using": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsusing-for-composite-actions", + "description": "To use a composite run steps action, set this to 'composite'.", + "const": "composite" + }, + "steps": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runssteps", + "description": "The run steps that you plan to run in this action.", + "type": "array", + "items": { + "type": "object", + "properties": { + "run": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsrun", + "description": "The command you want to run. This can be inline or a script in your action repository.", + "type": "string" + }, + "shell": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsshell", + "description": "The shell where you want to run the command.", + "type": "string", + "anyOf": [ + { + "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#custom-shell" + }, + { + "enum": [ + "bash", + "pwsh", + "python", + "sh", + "cmd", + "powershell" + ] + } + ] + }, + "uses": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsuses", + "description": "Selects an action to run as part of a step in your job.", + "type": "string" + }, + "with": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepswith", + "description": "A map of the input parameters defined by the action. Each input parameter is a key/value pair. Input parameters are set as environment variables. The variable is prefixed with INPUT_ and converted to upper case.", + "type": "object" + }, + "name": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsname", + "description": "The name of the composite run step.", + "type": "string" + }, + "id": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsid", + "description": "A unique identifier for the step. You can use the `id` to reference the step in contexts.", + "type": "string" + }, + "if": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsif", + "description": "You can use the if conditional to prevent a step from running unless a condition is met. You can use any supported context and expression to create a conditional.\nExpressions in an if conditional do not require the ${{ }} syntax. However, you must always use the ${{ }} expression syntax or escape with '', \"\", or () when the expression starts with !, since ! is reserved notation in YAML format. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions", + "type": "string" + }, + "env": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsenv", + "description": "Sets a map of environment variables for only that step.", + "oneOf": [ + { + "type": "object", + "additionalProperties": { + "oneOf": [ + { + "type": "string" + }, + { + "type": "number" + }, + { + "type": "boolean" + } + ] + } + }, + { + "$ref": "#/definitions/stringContainingExpressionSyntax" + } + ] + }, + "continue-on-error": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepscontinue-on-error", + "description": "Prevents a job from failing when a step fails. Set to true to allow a job to pass when this step fails.", + "oneOf": [ + { + "type": "boolean" + }, + { + "$ref": "#/definitions/expressionSyntax" + } + ], + "default": false + }, + "working-directory": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsworking-directory", + "description": "Specifies the working directory where the command is run.", + "type": "string" + } + }, + "oneOf": [ + { + "anyOf": [ + { + "not": { + "properties": { + "run": true + }, + "required": ["run"] + } + }, + { + "not": { + "properties": { + "shell": true + }, + "required": ["shell"] + } + } + ] + }, + { + "not": { + "properties": { + "uses": true + }, + "required": ["uses"] + } + } + ], + "additionalProperties": false + } + } + }, + "required": ["using", "steps"], + "additionalProperties": false + }, + "runs-docker": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-docker-container-actions", + "description": "Configures the image used for the Docker action.", + "type": "object", + "properties": { + "using": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsusing-for-docker-container-actions", + "description": "You must set this value to 'docker'.", + "const": "docker" + }, + "image": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsimage", + "description": "The Docker image to use as the container to run the action. The value can be the Docker base image name, a local `Dockerfile` in your repository, or a public image in Docker Hub or another registry. To reference a `Dockerfile` local to your repository, use a path relative to your action metadata file. The `docker` application will execute this file.", + "type": "string" + }, + "env": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsenv", + "description": "Specifies a key/value map of environment variables to set in the container environment.", + "oneOf": [ + { + "type": "object", + "additionalProperties": { + "oneOf": [ + { + "type": "string" + }, + { + "type": "number" + }, + { + "type": "boolean" + } + ] + } + }, + { + "$ref": "#/definitions/stringContainingExpressionSyntax" + } + ] + }, + "entrypoint": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsentrypoint", + "description": "Overrides the Docker `ENTRYPOINT` in the `Dockerfile`, or sets it if one wasn't already specified. Use `entrypoint` when the `Dockerfile` does not specify an `ENTRYPOINT` or you want to override the `ENTRYPOINT` instruction. If you omit `entrypoint`, the commands you specify in the Docker `ENTRYPOINT` instruction will execute. The Docker `ENTRYPOINT instruction has a *shell* form and *exec* form. The Docker `ENTRYPOINT` documentation recommends using the *exec* form of the `ENTRYPOINT` instruction.", + "type": "string" + }, + "pre-entrypoint": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runspre-entrypoint", + "description": "Allows you to run a script before the `entrypoint` action begins. For example, you can use `pre-entrypoint:` to run a prerequisite setup script. GitHub Actions uses `docker run` to launch this action, and runs the script inside a new container that uses the same base image. This means that the runtime state is different from the main `entrypoint` container, and any states you require must be accessed in either the workspace, `HOME`, or as a `STATE_` variable. The `pre-entrypoint:` action always runs by default but you can override this using `pre-if`.", + "type": "string" + }, + "pre-if": { + "$ref": "#/definitions/pre-if" + }, + "post-entrypoint": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runspost-entrypoint", + "description": "Allows you to run a cleanup script once the `runs.entrypoint` action has completed. GitHub Actions uses `docker run` to launch this action. Because GitHub Actions runs the script inside a new container using the same base image, the runtime state is different from the main `entrypoint` container. You can access any state you need in either the workspace, `HOME`, or as a `STATE_` variable. The `post-entrypoint:` action always runs by default but you can override this using `post-if`.", + "type": "string" + }, + "post-if": { + "$ref": "#/definitions/post-if" + }, + "args": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsargs", + "description": "An array of strings that define the inputs for a Docker container. Inputs can include hardcoded strings. GitHub passes the `args` to the container's `ENTRYPOINT` when the container starts up.\nThe `args` are used in place of the `CMD` instruction in a `Dockerfile`. If you use `CMD` in your `Dockerfile`, use the guidelines ordered by preference:\n- Document required arguments in the action's README and omit them from the `CMD` instruction.\n- Use defaults that allow using the action without specifying any `args`.\n- If the action exposes a `--help` flag, or something similar, use that to make your action self-documenting.", + "type": "array", + "items": { + "type": "string" + } + } + }, + "required": ["using", "image"], + "additionalProperties": false + }, + "outputs": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputs-for-docker-container-and-javascript-actions", + "description": "Output parameters allow you to declare data that an action sets. Actions that run later in a workflow can use the output data set in previously run actions. For example, if you had an action that performed the addition of two inputs (x + y = z), the action could output the sum (z) for other actions to use as an input.\nIf you don't declare an output in your action metadata file, you can still set outputs and use them in a workflow.", + "type": "object", + "patternProperties": { + "^[_a-zA-Z][a-zA-Z0-9_-]*$": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputsoutput_id", + "description": "A string identifier to associate with the output. The value of `` is a map of the output's metadata. The `` must be a unique identifier within the outputs object. The `` must start with a letter or `_` and contain only alphanumeric characters, `-`, or `_`.", + "type": "object", + "properties": { + "description": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputsoutput_iddescription", + "description": "A string description of the output parameter.", + "type": "string" + } + }, + "required": ["description"], + "additionalProperties": false + } + }, + "additionalProperties": false + }, + "outputs-composite": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputs-for-composite-actions", + "description": "Output parameters allow you to declare data that an action sets. Actions that run later in a workflow can use the output data set in previously run actions. For example, if you had an action that performed the addition of two inputs (x + y = z), the action could output the sum (z) for other actions to use as an input.\nIf you don't declare an output in your action metadata file, you can still set outputs and use them in a workflow.", + "type": "object", + "patternProperties": { + "^[_a-zA-Z][a-zA-Z0-9_-]*$": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputsoutput_id", + "description": "A string identifier to associate with the output. The value of `` is a map of the output's metadata. The `` must be a unique identifier within the outputs object. The `` must start with a letter or `_` and contain only alphanumeric characters, `-`, or `_`.", + "type": "object", + "properties": { + "description": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputsoutput_iddescription", + "description": "A string description of the output parameter.", + "type": "string" + }, + "value": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputsoutput_idvalue", + "description": "The value that the output parameter will be mapped to. You can set this to a string or an expression with context. For example, you can use the steps context to set the value of an output to the output value of a step.", + "type": "string" + } + }, + "required": ["description", "value"], + "additionalProperties": false + } + }, + "additionalProperties": false + } + }, + "else": { + "properties": { + "outputs": { + "$ref": "#/definitions/outputs" + } + } + }, + "if": { + "properties": { + "runs": { + "type": "object", + "properties": { + "using": { + "const": "composite" + } + } + } + } + }, + "properties": { + "name": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#name", + "description": "The name of your action. GitHub displays the `name` in the Actions tab to help visually identify actions in each job.", + "type": "string" + }, + "author": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#author", + "description": "The name of the action's author.", + "type": "string" + }, + "description": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#description", + "description": "A short description of the action.", + "type": "string" + }, + "inputs": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputs", + "description": "Input parameters allow you to specify data that the action expects to use during runtime. GitHub stores input parameters as environment variables. Input ids with uppercase letters are converted to lowercase during runtime. We recommended using lowercase input ids.", + "type": "object", + "patternProperties": { + "^[_a-zA-Z][a-zA-Z0-9_-]*$": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputsinput_id", + "description": "A string identifier to associate with the input. The value of `` is a map of the input's metadata. The `` must be a unique identifier within the inputs object. The `` must start with a letter or `_` and contain only alphanumeric characters, `-`, or `_`.", + "type": "object", + "properties": { + "description": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputsinput_iddescription", + "description": "A string description of the input parameter.", + "type": "string" + }, + "deprecationMessage": { + "description": "A string shown to users using the deprecated input.", + "type": "string" + }, + "required": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputsinput_idrequired", + "description": "A boolean to indicate whether the action requires the input parameter. Set to `true` when the parameter is required.", + "type": "boolean" + }, + "default": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputsinput_iddefault", + "description": "A string representing the default value. The default value is used when an input parameter isn't specified in a workflow file.", + "type": "string" + } + }, + "required": ["description"], + "additionalProperties": false + } + }, + "additionalProperties": false + }, + "outputs": { + "$comment": "Because of `additionalProperties: false`, this empty schema is needed to allow the `outputs` property. The `outputs` subschema is determined by the if/then/else keywords." + }, + "runs": { + "oneOf": [ + { + "$ref": "#/definitions/runs-javascript" + }, + { + "$ref": "#/definitions/runs-composite" + }, + { + "$ref": "#/definitions/runs-docker" + } + ] + }, + "branding": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#branding", + "description": "You can use a color and Feather icon to create a badge to personalize and distinguish your action. Badges are shown next to your action name in GitHub Marketplace.", + "type": "object", + "properties": { + "color": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#brandingcolor", + "description": "The background color of the badge.", + "type": "string", + "enum": [ + "white", + "black", + "yellow", + "blue", + "green", + "orange", + "red", + "purple", + "gray-dark" + ] + }, + "icon": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#brandingicon", + "description": "The name of the Feather icon to use.", + "type": "string", + "enum": [ + "activity", + "airplay", + "alert-circle", + "alert-octagon", + "alert-triangle", + "align-center", + "align-justify", + "align-left", + "align-right", + "anchor", + "aperture", + "archive", + "arrow-down-circle", + "arrow-down-left", + "arrow-down-right", + "arrow-down", + "arrow-left-circle", + "arrow-left", + "arrow-right-circle", + "arrow-right", + "arrow-up-circle", + "arrow-up-left", + "arrow-up-right", + "arrow-up", + "at-sign", + "award", + "bar-chart-2", + "bar-chart", + "battery-charging", + "battery", + "bell-off", + "bell", + "bluetooth", + "bold", + "book-open", + "book", + "bookmark", + "box", + "briefcase", + "calendar", + "camera-off", + "camera", + "cast", + "check-circle", + "check-square", + "check", + "chevron-down", + "chevron-left", + "chevron-right", + "chevron-up", + "chevrons-down", + "chevrons-left", + "chevrons-right", + "chevrons-up", + "circle", + "clipboard", + "clock", + "cloud-drizzle", + "cloud-lightning", + "cloud-off", + "cloud-rain", + "cloud-snow", + "cloud", + "code", + "command", + "compass", + "copy", + "corner-down-left", + "corner-down-right", + "corner-left-down", + "corner-left-up", + "corner-right-down", + "corner-right-up", + "corner-up-left", + "corner-up-right", + "cpu", + "credit-card", + "crop", + "crosshair", + "database", + "delete", + "disc", + "dollar-sign", + "download-cloud", + "download", + "droplet", + "edit-2", + "edit-3", + "edit", + "external-link", + "eye-off", + "eye", + "fast-forward", + "feather", + "file-minus", + "file-plus", + "file-text", + "file", + "film", + "filter", + "flag", + "folder-minus", + "folder-plus", + "folder", + "gift", + "git-branch", + "git-commit", + "git-merge", + "git-pull-request", + "globe", + "grid", + "hard-drive", + "hash", + "headphones", + "heart", + "help-circle", + "home", + "image", + "inbox", + "info", + "italic", + "layers", + "layout", + "life-buoy", + "link-2", + "link", + "list", + "loader", + "lock", + "log-in", + "log-out", + "mail", + "map-pin", + "map", + "maximize-2", + "maximize", + "menu", + "message-circle", + "message-square", + "mic-off", + "mic", + "minimize-2", + "minimize", + "minus-circle", + "minus-square", + "minus", + "monitor", + "moon", + "more-horizontal", + "more-vertical", + "move", + "music", + "navigation-2", + "navigation", + "octagon", + "package", + "paperclip", + "pause-circle", + "pause", + "percent", + "phone-call", + "phone-forwarded", + "phone-incoming", + "phone-missed", + "phone-off", + "phone-outgoing", + "phone", + "pie-chart", + "play-circle", + "play", + "plus-circle", + "plus-square", + "plus", + "pocket", + "power", + "printer", + "radio", + "refresh-ccw", + "refresh-cw", + "repeat", + "rewind", + "rotate-ccw", + "rotate-cw", + "rss", + "save", + "scissors", + "search", + "send", + "server", + "settings", + "share-2", + "share", + "shield-off", + "shield", + "shopping-bag", + "shopping-cart", + "shuffle", + "sidebar", + "skip-back", + "skip-forward", + "slash", + "sliders", + "smartphone", + "speaker", + "square", + "star", + "stop-circle", + "sun", + "sunrise", + "sunset", + "table", + "tablet", + "tag", + "target", + "terminal", + "thermometer", + "thumbs-down", + "thumbs-up", + "toggle-left", + "toggle-right", + "trash-2", + "trash", + "trending-down", + "trending-up", + "triangle", + "truck", + "tv", + "type", + "umbrella", + "underline", + "unlock", + "upload-cloud", + "upload", + "user-check", + "user-minus", + "user-plus", + "user-x", + "user", + "users", + "video-off", + "video", + "voicemail", + "volume-1", + "volume-2", + "volume-x", + "volume", + "watch", + "wifi-off", + "wifi", + "wind", + "x-circle", + "x-square", + "x", + "zap-off", + "zap", + "zoom-in", + "zoom-out" + ] + } + }, + "additionalProperties": false + } + }, + "required": ["name", "description", "runs"], + "then": { + "properties": { + "outputs": { + "$ref": "#/definitions/outputs-composite" + } + } + }, + "type": "object" +} diff --git a/schemas/github-workflow.json b/schemas/github-workflow.json new file mode 100644 index 0000000..aee6350 --- /dev/null +++ b/schemas/github-workflow.json @@ -0,0 +1,2308 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "$id": "https://json.schemastore.org/github-workflow.json", + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions", + "additionalProperties": false, + "definitions": { + "architecture": { + "type": "string", + "enum": ["ARM32", "x64", "x86"] + }, + "branch": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#onpushpull_requestbranchestags", + "$ref": "#/definitions/globs", + "description": "When using the push and pull_request events, you can configure a workflow to run on specific branches or tags. If you only define only tags or only branches, the workflow won't run for events affecting the undefined Git ref.\nThe branches, branches-ignore, tags, and tags-ignore keywords accept glob patterns that use the * and ** wildcard characters to match more than one branch or tag name. For more information, see https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet.\nThe patterns defined in branches and tags are evaluated against the Git ref's name. For example, defining the pattern mona/octocat in branches will match the refs/heads/mona/octocat Git ref. The pattern releases/** will match the refs/heads/releases/10 Git ref.\nYou can use two types of filters to prevent a workflow from running on pushes and pull requests to tags and branches:\n- branches or branches-ignore - You cannot use both the branches and branches-ignore filters for the same event in a workflow. Use the branches filter when you need to filter branches for positive matches and exclude branches. Use the branches-ignore filter when you only need to exclude branch names.\n- tags or tags-ignore - You cannot use both the tags and tags-ignore filters for the same event in a workflow. Use the tags filter when you need to filter tags for positive matches and exclude tags. Use the tags-ignore filter when you only need to exclude tag names.\nYou can exclude tags and branches using the ! character. The order that you define patterns matters.\n- A matching negative pattern (prefixed with !) after a positive match will exclude the Git ref.\n- A matching positive pattern after a negative match will include the Git ref again." + }, + "cacheMode": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#cache-mode", + "description": "Controls the level of GitHub Actions cache access granted to a workflow or job.", + "type": "string", + "enum": ["read", "write", "write-only", "none"] + }, + "concurrency": { + "type": "object", + "properties": { + "group": { + "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#example-using-concurrency-to-cancel-any-in-progress-job-or-run-1", + "description": "When a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. By default any previously pending job or workflow in the concurrency group will be canceled; this behavior can be changed with `queue`.", + "type": "string" + }, + "cancel-in-progress": { + "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#example-using-concurrency-to-cancel-any-in-progress-job-or-run-1", + "description": "To cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.", + "oneOf": [ + { + "type": "boolean" + }, + { + "$ref": "#/definitions/expressionSyntax" + } + ] + }, + "queue": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#example-queueing-multiple-pending-runs", + "description": "Controls how pending jobs or workflow runs are queued within a concurrency group. With the default `single`, at most one run can be pending — additional pending runs cancel the previous one. With `max`, up to 100 runs can be pending and are processed in FIFO order. The combination of `queue: max` and `cancel-in-progress: true` is not allowed.", + "type": "string", + "enum": ["single", "max"], + "default": "single" + } + }, + "required": ["group"], + "additionalProperties": false + }, + "configuration": { + "oneOf": [ + { + "type": "string" + }, + { + "type": "number" + }, + { + "type": "boolean" + }, + { + "type": "object", + "additionalProperties": { + "$ref": "#/definitions/configuration" + } + }, + { + "type": "array", + "items": { + "$ref": "#/definitions/configuration" + } + } + ] + }, + "jobContainer": { + "type": "object", + "properties": { + "image": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcontainerimage", + "description": "The Docker image to use as the container to run the action. The value can be the Docker Hub image name or a registry name.", + "type": "string" + }, + "credentials": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcontainercredentials", + "description": "If the image's container registry requires authentication to pull the image, you can use credentials to set a map of the username and password. The credentials are the same values that you would provide to the `docker login` command.", + "type": "object", + "properties": { + "username": { + "type": "string" + }, + "password": { + "type": "string" + } + } + }, + "env": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcontainerenv", + "$ref": "#/definitions/env", + "description": "Sets a map of environment variables in the container." + }, + "ports": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcontainerports", + "description": "Sets an array of ports to expose on the container.", + "type": "array", + "items": { + "oneOf": [ + { + "type": "number" + }, + { + "type": "string" + } + ] + }, + "minItems": 1 + }, + "volumes": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcontainervolumes", + "description": "Sets an array of volumes for the container to use. You can use volumes to share data between services or other steps in a job. You can specify named Docker volumes, anonymous Docker volumes, or bind mounts on the host.\nTo specify a volume, you specify the source and destination path: :\nThe is a volume name or an absolute path on the host machine, and is an absolute path in the container.", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + }, + "options": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcontaineroptions", + "description": "Additional Docker container resource options. For a list of options, see https://docs.docker.com/engine/reference/commandline/create/#options.", + "type": "string" + } + }, + "required": ["image"], + "additionalProperties": false + }, + "serviceContainer": { + "type": "object", + "properties": { + "image": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idservicesservice_idimage", + "description": "The Docker image to use as the service container to run the action. The value can be the Docker Hub image name or a registry name.", + "type": "string" + }, + "credentials": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idservicesservice_idcredentials", + "description": "If the image's container registry requires authentication to pull the image, you can use credentials to set a map of the username and password. The credentials are the same values that you would provide to the `docker login` command.", + "type": "object", + "properties": { + "username": { + "type": "string" + }, + "password": { + "type": "string" + } + } + }, + "env": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idservicesservice_idenv", + "$ref": "#/definitions/env", + "description": "Sets a map of environment variables in the service container." + }, + "ports": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idservicesservice_idports", + "description": "Sets an array of ports to expose on the service container.", + "type": "array", + "items": { + "oneOf": [ + { + "type": "number" + }, + { + "type": "string" + } + ] + }, + "minItems": 1 + }, + "volumes": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idservicesservice_idvolumes", + "description": "Sets an array of volumes for the service container to use. You can use volumes to share data between services or other steps in a job. You can specify named Docker volumes, anonymous Docker volumes, or bind mounts on the host.\nTo specify a volume, you specify the source and destination path: :\nThe is a volume name or an absolute path on the host machine, and is an absolute path in the container.", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + }, + "options": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idservicesservice_idoptions", + "description": "Additional Docker container resource options. For a list of options, see https://docs.docker.com/engine/reference/commandline/create/#options.", + "type": "string" + }, + "command": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idservicesservice_idcommand", + "description": "Overrides the Docker image's default command (`CMD`). The value is passed as arguments after the image name in the `docker create` command. If you also specify `entrypoint`, `command` provides the arguments to that entrypoint.", + "type": "string" + }, + "entrypoint": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idservicesservice_identrypoint", + "description": "Overrides the Docker image's default `ENTRYPOINT`. The value is a single string defining the executable to run. Use this when you need to replace the image's entrypoint entirely. You can combine `entrypoint` with `command` to pass arguments to the custom entrypoint.", + "type": "string" + } + }, + "required": ["image"], + "additionalProperties": false + }, + "defaults": { + "type": "object", + "properties": { + "run": { + "type": "object", + "properties": { + "shell": { + "$ref": "#/definitions/shell" + }, + "working-directory": { + "$ref": "#/definitions/working-directory" + } + }, + "minProperties": 1, + "additionalProperties": false + } + }, + "minProperties": 1, + "additionalProperties": false + }, + "permissions": { + "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#permissions", + "description": "You can modify the default permissions granted to the GITHUB_TOKEN, adding or removing access as required, so that you only allow the minimum required access.", + "oneOf": [ + { + "type": "string", + "enum": ["read-all", "write-all"] + }, + { + "$ref": "#/definitions/permissions-event" + } + ] + }, + "permissions-event": { + "type": "object", + "additionalProperties": false, + "properties": { + "actions": { + "$ref": "#/definitions/permissions-level" + }, + "artifact-metadata": { + "$ref": "#/definitions/permissions-level" + }, + "attestations": { + "$ref": "#/definitions/permissions-level" + }, + "checks": { + "$ref": "#/definitions/permissions-level" + }, + "code-quality": { + "$ref": "#/definitions/permissions-level" + }, + "contents": { + "$ref": "#/definitions/permissions-level" + }, + "deployments": { + "$ref": "#/definitions/permissions-level" + }, + "discussions": { + "$ref": "#/definitions/permissions-level" + }, + "id-token": { + "type": "string", + "enum": ["write", "none"] + }, + "issues": { + "$ref": "#/definitions/permissions-level" + }, + "models": { + "type": "string", + "enum": ["read", "none"] + }, + "packages": { + "$ref": "#/definitions/permissions-level" + }, + "pages": { + "$ref": "#/definitions/permissions-level" + }, + "pull-requests": { + "$ref": "#/definitions/permissions-level" + }, + "repository-projects": { + "$ref": "#/definitions/permissions-level" + }, + "security-events": { + "$ref": "#/definitions/permissions-level" + }, + "statuses": { + "$ref": "#/definitions/permissions-level" + }, + "vulnerability-alerts": { + "type": "string", + "enum": ["read", "none"] + }, + "copilot-requests": { + "type": "string", + "enum": ["write"] + } + } + }, + "permissions-level": { + "type": "string", + "enum": ["read", "write", "none"] + }, + "env": { + "$comment": "https://docs.github.com/en/actions/learn-github-actions/environment-variables", + "description": "To set custom environment variables, you need to specify the variables in the workflow file. You can define environment variables for a step, job, or entire workflow using the jobs..steps[*].env, jobs..env, and env keywords. For more information, see https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsenv", + "oneOf": [ + { + "type": "object", + "additionalProperties": { + "oneOf": [ + { + "type": "string" + }, + { + "type": "number" + }, + { + "type": "boolean" + } + ] + } + }, + { + "$ref": "#/definitions/stringContainingExpressionSyntax" + } + ] + }, + "environment": { + "$comment": "https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idenvironment", + "description": "The environment that the job references", + "type": "object", + "properties": { + "name": { + "$comment": "https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#example-using-a-single-environment-name", + "description": "The name of the environment configured in the repo.", + "type": "string" + }, + "url": { + "$comment": "https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#example-using-environment-name-and-url", + "description": "A deployment URL", + "type": "string" + }, + "deployment": { + "$comment": "https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/control-deployments#using-environments-without-deployments", + "description": "Whether to create a deployment for this job. Setting to false lets the job use environment secrets and variables without creating a deployment record. Wait timers and required reviewers still apply.", + "oneOf": [ + { + "type": "boolean" + }, + { + "$ref": "#/definitions/expressionSyntax" + } + ], + "default": true + } + }, + "required": ["name"], + "additionalProperties": false + }, + "event": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows", + "type": "string", + "enum": [ + "branch_protection_rule", + "check_run", + "check_suite", + "create", + "delete", + "deployment", + "deployment_status", + "discussion", + "discussion_comment", + "fork", + "gollum", + "issue_comment", + "issues", + "label", + "merge_group", + "milestone", + "page_build", + "project", + "project_card", + "project_column", + "public", + "pull_request", + "pull_request_review", + "pull_request_review_comment", + "pull_request_target", + "push", + "registry_package", + "release", + "status", + "watch", + "workflow_call", + "workflow_dispatch", + "workflow_run", + "repository_dispatch" + ] + }, + "eventObject": { + "oneOf": [ + { + "type": "object", + "additionalProperties": true + }, + { + "type": "null" + } + ] + }, + "expressionSyntax": { + "$comment": "escape `{` and `}` in pattern to be unicode compatible (#1360)", + "type": "string", + "pattern": "^\\$\\{\\{(.|[\r\n])*\\}\\}$" + }, + "stringContainingExpressionSyntax": { + "$comment": "escape `{` and `}` in pattern to be unicode compatible (#1360)", + "type": "string", + "pattern": "^.*\\$\\{\\{(.|[\r\n])*\\}\\}.*$" + }, + "globs": { + "type": "array", + "items": { + "type": "string", + "minLength": 1 + }, + "minItems": 1 + }, + "machine": { + "type": "string", + "enum": ["linux", "macos", "windows"] + }, + "name": { + "type": "string", + "pattern": "^[_a-zA-Z][a-zA-Z0-9_-]*$" + }, + "path": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#onpushpull_requestpaths", + "$ref": "#/definitions/globs", + "description": "When using the push and pull_request events, you can configure a workflow to run when at least one file does not match paths-ignore or at least one modified file matches the configured paths. Path filters are not evaluated for pushes to tags.\nThe paths-ignore and paths keywords accept glob patterns that use the * and ** wildcard characters to match more than one path name. For more information, see https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet.\nYou can exclude paths using two types of filters. You cannot use both of these filters for the same event in a workflow.\n- paths-ignore - Use the paths-ignore filter when you only need to exclude path names.\n- paths - Use the paths filter when you need to filter paths for positive matches and exclude paths." + }, + "shell": { + "$comment": "https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell", + "description": "You can override the default shell settings in the runner's operating system using the shell keyword. You can use built-in shell keywords, or you can define a custom set of shell options.", + "anyOf": [ + { + "type": "string" + }, + { + "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#custom-shell", + "type": "string", + "enum": ["bash", "pwsh", "python", "sh", "cmd", "powershell"] + } + ] + }, + "snapshot": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idsnapshot", + "description": "You can use `jobs..snapshot` to generate a custom image.\nAdd the snapshot keyword to the job, using either the string syntax or mapping syntax as shown in https://docs.github.com/en/actions/how-tos/manage-runners/larger-runners/use-custom-images#generating-a-custom-image.\nEach job that includes the snapshot keyword creates a separate image. To generate only one image or image version, include all workflow steps in a single job. Each successful run of a job that includes the snapshot keyword creates a new version of that image.\nFor more information, see https://docs.github.com/en/actions/how-tos/manage-runners/larger-runners/use-custom-images.", + "oneOf": [ + { + "$comment": "https://docs.github.com/en/actions/how-tos/manage-runners/larger-runners/use-custom-images#string-syntax", + "type": "string", + "description": "You can use the string syntax with `snapshot` to define the image name. This method creates a new image or adds a new version to an existing image with the same name. You cannot specify a version number using this syntax." + }, + { + "$comment": "https://docs.github.com/en/actions/how-tos/manage-runners/larger-runners/use-custom-images#mapping-syntax", + "type": "object", + "additionalProperties": false, + "description": "You can use the mapping syntax with `snapshot` to define both the `image-name` and the optional `version`. When you specify a major version, the minor versioning automatically increments if that major version already exists. Patch versions are not supported.", + "properties": { + "image-name": { + "type": "string" + }, + "version": { + "$comment": "https://docs.github.com/en/actions/how-tos/manage-runners/larger-runners/use-custom-images#specifying-a-version-in-your-workflow", + "type": "string", + "pattern": "^\\d+(\\.\\d+|\\*)?$" + } + }, + "required": ["image-name"] + } + ] + }, + "step": { + "type": "object", + "additionalProperties": false, + "dependencies": { + "working-directory": ["run"], + "shell": ["run"] + }, + "oneOf": [ + { + "type": "object", + "properties": { + "uses": true + }, + "required": ["uses"] + }, + { + "type": "object", + "properties": { + "run": true + }, + "required": ["run"] + }, + { + "type": "object", + "properties": { + "wait": true + }, + "required": ["wait"] + }, + { + "type": "object", + "properties": { + "wait-all": true + }, + "required": ["wait-all"] + }, + { + "type": "object", + "properties": { + "cancel": true + }, + "required": ["cancel"] + }, + { + "type": "object", + "properties": { + "parallel": true + }, + "required": ["parallel"] + } + ], + "properties": { + "id": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsid", + "description": "A unique identifier for the step. You can use the id to reference the step in contexts. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.", + "type": "string" + }, + "if": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsif", + "description": "You can use the if conditional to prevent a step from running unless a condition is met. You can use any supported context and expression to create a conditional.\nExpressions in an if conditional do not require the ${{ }} syntax. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.", + "anyOf": [ + { + "type": "boolean" + }, + { + "type": "number" + }, + { + "type": "string" + } + ] + }, + "name": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsname", + "description": "A name for your step to display on GitHub.", + "type": "string" + }, + "uses": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsuses", + "description": "Selects an action to run as part of a step in your job. An action is a reusable unit of code. You can use an action defined in the same repository as the workflow, a public repository, or in a published Docker container image (https://hub.docker.com/).\nWe strongly recommend that you include the version of the action you are using by specifying a Git ref, SHA, or Docker tag number. If you don't specify a version, it could break your workflows or cause unexpected behavior when the action owner publishes an update.\n- Using the commit SHA of a released action version is the safest for stability and security.\n- Using the specific major action version allows you to receive critical fixes and security patches while still maintaining compatibility. It also assures that your workflow should still work.\n- Using the master branch of an action may be convenient, but if someone releases a new major version with a breaking change, your workflow could break.\nSome actions require inputs that you must set using the with keyword. Review the action's README file to determine the inputs required.\nActions are either JavaScript files or Docker containers. If the action you're using is a Docker container you must run the job in a Linux virtual environment. For more details, see https://help.github.com/en/articles/virtual-environments-for-github-actions.", + "type": "string" + }, + "run": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsrun", + "description": "Runs command-line programs using the operating system's shell. If you do not provide a name, the step name will default to the text specified in the run command.\nCommands run using non-login shells by default. You can choose a different shell and customize the shell used to run commands. For more information, see https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#using-a-specific-shell.\nEach run keyword represents a new process and shell in the virtual environment. When you provide multi-line commands, each line runs in the same shell.", + "type": "string" + }, + "working-directory": { + "$ref": "#/definitions/working-directory" + }, + "shell": { + "$ref": "#/definitions/shell" + }, + "with": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepswith", + "$ref": "#/definitions/env", + "description": "A map of the input parameters defined by the action. Each input parameter is a key/value pair. Input parameters are set as environment variables. The variable is prefixed with INPUT_ and converted to upper case.", + "anyOf": [ + { + "$ref": "#/definitions/env" + }, + { + "type": "object", + "properties": { + "args": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepswithargs", + "type": "string" + }, + "entrypoint": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepswithentrypoint", + "type": "string" + } + } + } + ] + }, + "env": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsenv", + "$ref": "#/definitions/env", + "description": "Sets environment variables for steps to use in the virtual environment. You can also set environment variables for the entire workflow or a job." + }, + "continue-on-error": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepscontinue-on-error", + "description": "Prevents a job from failing when a step fails. Set to true to allow a job to pass when this step fails.", + "oneOf": [ + { + "type": "boolean" + }, + { + "$ref": "#/definitions/expressionSyntax" + } + ], + "default": false + }, + "timeout-minutes": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepstimeout-minutes", + "description": "The maximum number of minutes to run the step before killing the process.", + "oneOf": [ + { + "type": "number" + }, + { + "$ref": "#/definitions/expressionSyntax" + } + ] + }, + "background": { + "$comment": "https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsbackground", + "description": "Runs a step asynchronously so the job continues to the next step without waiting for it to finish. You can use background on steps that use run or uses. To reference a background step from wait or cancel, give it an id. A maximum of 10 background steps can run concurrently in a single job.", + "type": "boolean" + }, + "wait": { + "$comment": "https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idstepswait", + "description": "Pauses the job until one or more background steps complete. Provide a single step id as a string, or multiple step ids as an array. After a wait step completes, the outputs of the referenced background steps become available to subsequent steps.", + "oneOf": [ + { + "type": "string" + }, + { + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + } + ] + }, + "wait-all": { + "$comment": "https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idstepswait-all", + "description": "Pauses the job until all active background steps complete. The wait-all keyword takes no arguments.", + "anyOf": [ + { + "type": "boolean" + }, + { + "type": "null" + } + ] + }, + "cancel": { + "$comment": "https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idstepscancel", + "description": "Gracefully terminates a running background step. The runner sends the step's process a termination signal (SIGTERM) so it can clean up. The cancel keyword targets a single background step by its id.", + "type": "string" + }, + "parallel": { + "$comment": "https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsparallel", + "description": "Runs a group of steps concurrently, then waits for all of them to finish before continuing. Every step in the group runs as a background step, with an implicit wait at the end of the group.", + "type": "array", + "items": { + "$ref": "#/definitions/step" + }, + "minItems": 1 + } + } + }, + "types": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#onevent_nametypes", + "description": "Selects the types of activity that will trigger a workflow run. Most GitHub events are triggered by more than one type of activity. For example, the event for the release resource is triggered when a release is published, unpublished, created, edited, deleted, or prereleased. The types keyword enables you to narrow down activity that causes the workflow to run. When only one activity type triggers a webhook event, the types keyword is unnecessary.\nYou can use an array of event types. For more information about each event and their activity types, see https://help.github.com/en/articles/events-that-trigger-workflows#webhook-events.", + "oneOf": [ + { + "type": "array", + "minItems": 1 + }, + { + "type": "string" + } + ] + }, + "working-directory": { + "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsrun", + "description": "Using the working-directory keyword, you can specify the working directory of where to run the command.", + "type": "string" + }, + "jobNeeds": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idneeds", + "description": "Identifies any jobs that must complete successfully before this job will run. It can be a string or array of strings. If a job fails, all jobs that need it are skipped unless the jobs use a conditional statement that causes the job to continue.", + "oneOf": [ + { + "type": "array", + "items": { + "$ref": "#/definitions/name" + }, + "minItems": 1 + }, + { + "$ref": "#/definitions/name" + } + ] + }, + "matrix": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategymatrix", + "description": "A build matrix is a set of different configurations of the virtual environment. For example you might run a job against more than one supported version of a language, operating system, or tool. Each configuration is a copy of the job that runs and reports a status.\nYou can specify a matrix by supplying an array for the configuration options. For example, if the GitHub virtual environment supports Node.js versions 6, 8, and 10 you could specify an array of those versions in the matrix.\nWhen you define a matrix of operating systems, you must set the required runs-on keyword to the operating system of the current job, rather than hard-coding the operating system name. To access the operating system name, you can use the matrix.os context parameter to set runs-on. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.", + "oneOf": [ + { + "type": "object", + "patternProperties": { + "^(in|ex)clude$": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#example-including-configurations-in-a-matrix-build", + "oneOf": [ + { + "$ref": "#/definitions/expressionSyntax" + }, + { + "type": "array", + "items": { + "type": "object", + "additionalProperties": { + "$ref": "#/definitions/configuration" + } + }, + "minItems": 1 + } + ] + } + }, + "additionalProperties": { + "oneOf": [ + { + "type": "array", + "items": { + "$ref": "#/definitions/configuration" + }, + "minItems": 1 + }, + { + "$ref": "#/definitions/expressionSyntax" + } + ] + }, + "minProperties": 1 + }, + { + "$ref": "#/definitions/expressionSyntax" + } + ] + }, + "reusableWorkflowCallJob": { + "$comment": "https://docs.github.com/en/actions/learn-github-actions/reusing-workflows#calling-a-reusable-workflow", + "description": "Each job must have an id to associate with the job. The key job_id is a string and its value is a map of the job's configuration data. You must replace with a string that is unique to the jobs object. The must start with a letter or _ and contain only alphanumeric characters, -, or _.", + "type": "object", + "properties": { + "name": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idname", + "description": "The name of the job displayed on GitHub.", + "type": "string" + }, + "needs": { + "$ref": "#/definitions/jobNeeds" + }, + "permissions": { + "$ref": "#/definitions/permissions" + }, + "cache-mode": { + "$ref": "#/definitions/cacheMode" + }, + "if": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idif", + "description": "You can use the if conditional to prevent a job from running unless a condition is met. You can use any supported context and expression to create a conditional.\nExpressions in an if conditional do not require the ${{ }} syntax. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.", + "anyOf": [ + { + "type": "boolean" + }, + { + "type": "number" + }, + { + "type": "string" + } + ] + }, + "uses": { + "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#jobsjob_iduses", + "description": "The location and version of a reusable workflow file to run as a job, of the form './{path/to}/{localfile}.yml' or '{owner}/{repo}/{path}/{filename}@{ref}'. {ref} can be a SHA, a release tag, or a branch name. Using the commit SHA is the safest for stability and security.", + "type": "string", + "pattern": "^(.+\\/)+(.+)\\.(ya?ml)(@.+)?$" + }, + "with": { + "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#jobsjob_idwith", + "$ref": "#/definitions/env", + "description": "A map of inputs that are passed to the called workflow. Any inputs that you pass must match the input specifications defined in the called workflow. Unlike 'jobs..steps[*].with', the inputs you pass with 'jobs..with' are not be available as environment variables in the called workflow. Instead, you can reference the inputs by using the inputs context." + }, + "secrets": { + "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#jobsjob_idsecrets", + "description": "When a job is used to call a reusable workflow, you can use 'secrets' to provide a map of secrets that are passed to the called workflow. Any secrets that you pass must match the names defined in the called workflow.", + "oneOf": [ + { + "$ref": "#/definitions/env" + }, + { + "type": "string", + "enum": ["inherit"] + } + ] + }, + "strategy": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategy", + "description": "A strategy creates a build matrix for your jobs. You can define different variations of an environment to run each job in.", + "type": "object", + "properties": { + "matrix": { + "$ref": "#/definitions/matrix" + }, + "fail-fast": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategyfail-fast", + "description": "When set to true, GitHub cancels all in-progress jobs if any matrix job fails. Default: true", + "anyOf": [ + { + "type": "boolean" + }, + { + "type": "string" + } + ], + "default": true + }, + "max-parallel": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategymax-parallel", + "description": "The maximum number of jobs that can run simultaneously when using a matrix job strategy. By default, GitHub will maximize the number of jobs run in parallel depending on the available runners on GitHub-hosted virtual machines.", + "anyOf": [ + { + "type": "number" + }, + { + "type": "string" + } + ] + } + }, + "required": ["matrix"], + "additionalProperties": false + }, + "concurrency": { + "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idconcurrency", + "description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. \nYou can also specify concurrency at the workflow level. \nWhen a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. By default any previously pending job or workflow in the concurrency group will be canceled; this behavior can be changed with `queue`. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.", + "oneOf": [ + { + "type": "string" + }, + { + "$ref": "#/definitions/concurrency" + } + ] + } + }, + "required": ["uses"], + "additionalProperties": false + }, + "normalJob": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_id", + "description": "Each job must have an id to associate with the job. The key job_id is a string and its value is a map of the job's configuration data. You must replace with a string that is unique to the jobs object. The must start with a letter or _ and contain only alphanumeric characters, -, or _.", + "type": "object", + "properties": { + "name": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idname", + "description": "The name of the job displayed on GitHub.", + "type": "string" + }, + "needs": { + "$ref": "#/definitions/jobNeeds" + }, + "snapshot": { + "$ref": "#/definitions/snapshot" + }, + "permissions": { + "$ref": "#/definitions/permissions" + }, + "cache-mode": { + "$ref": "#/definitions/cacheMode" + }, + "runs-on": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idruns-on", + "description": "The type of machine to run the job on. The machine can be either a GitHub-hosted runner, or a self-hosted runner.", + "anyOf": [ + { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#github-hosted-runners", + "type": "string" + }, + { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#self-hosted-runners", + "type": "array", + "anyOf": [ + { + "items": { + "type": "string" + }, + "minItems": 1 + } + ] + }, + { + "$comment": "https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#choosing-runners-in-a-group", + "type": "object", + "properties": { + "group": { + "type": "string" + }, + "labels": { + "oneOf": [ + { + "type": "string" + }, + { + "type": "array", + "items": { + "type": "string" + } + } + ] + } + } + }, + { + "$ref": "#/definitions/stringContainingExpressionSyntax" + }, + { + "$ref": "#/definitions/expressionSyntax" + } + ] + }, + "environment": { + "$comment": "https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idenvironment", + "description": "The environment that the job references.", + "oneOf": [ + { + "type": "string" + }, + { + "$ref": "#/definitions/environment" + } + ] + }, + "outputs": { + "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idoutputs", + "description": "A map of outputs for a job. Job outputs are available to all downstream jobs that depend on this job.", + "type": "object", + "additionalProperties": { + "type": "string" + }, + "minProperties": 1 + }, + "env": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idenv", + "$ref": "#/definitions/env", + "description": "A map of environment variables that are available to all steps in the job." + }, + "defaults": { + "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_iddefaults", + "$ref": "#/definitions/defaults", + "description": "A map of default settings that will apply to all steps in the job." + }, + "if": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idif", + "description": "You can use the if conditional to prevent a job from running unless a condition is met. You can use any supported context and expression to create a conditional.\nExpressions in an if conditional do not require the ${{ }} syntax. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.", + "anyOf": [ + { + "type": "boolean" + }, + { + "type": "number" + }, + { + "type": "string" + } + ] + }, + "steps": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idsteps", + "description": "A job contains a sequence of tasks called steps. Steps can run commands, run setup tasks, or run an action in your repository, a public repository, or an action published in a Docker registry. Not all steps run actions, but all actions run as a step. Each step runs in its own process in the virtual environment and has access to the workspace and filesystem. Because steps run in their own process, changes to environment variables are not preserved between steps. GitHub provides built-in steps to set up and complete a job.\nMust contain either `uses` or `run`\n", + "type": "array", + "items": { + "$ref": "#/definitions/step" + }, + "minItems": 1 + }, + "timeout-minutes": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idtimeout-minutes", + "description": "The maximum number of minutes to let a workflow run before GitHub automatically cancels it. Default: 360", + "oneOf": [ + { + "type": "number" + }, + { + "$ref": "#/definitions/expressionSyntax" + } + ], + "default": 360 + }, + "strategy": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategy", + "description": "A strategy creates a build matrix for your jobs. You can define different variations of an environment to run each job in.", + "type": "object", + "properties": { + "matrix": { + "$ref": "#/definitions/matrix" + }, + "fail-fast": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategyfail-fast", + "description": "When set to true, GitHub cancels all in-progress jobs if any matrix job fails. Default: true", + "anyOf": [ + { + "type": "boolean" + }, + { + "type": "string" + } + ], + "default": true + }, + "max-parallel": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategymax-parallel", + "description": "The maximum number of jobs that can run simultaneously when using a matrix job strategy. By default, GitHub will maximize the number of jobs run in parallel depending on the available runners on GitHub-hosted virtual machines.", + "anyOf": [ + { + "type": "number" + }, + { + "type": "string" + } + ] + } + }, + "required": ["matrix"], + "additionalProperties": false + }, + "continue-on-error": { + "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontinue-on-error", + "description": "Prevents a workflow run from failing when a job fails. Set to true to allow a workflow run to pass when this job fails.", + "oneOf": [ + { + "type": "boolean" + }, + { + "$ref": "#/definitions/expressionSyntax" + } + ] + }, + "container": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idcontainer", + "description": "A container to run any steps in a job that don't already specify a container. If you have steps that use both script and container actions, the container actions will run as sibling containers on the same network with the same volume mounts.\nIf you do not set a container, all steps will run directly on the host specified by runs-on unless a step refers to an action configured to run in a container.", + "oneOf": [ + { + "type": "string" + }, + { + "$ref": "#/definitions/jobContainer" + } + ] + }, + "services": { + "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idservices", + "description": "Additional containers to host services for a job in a workflow. These are useful for creating databases or cache services like redis. The runner on the virtual machine will automatically create a network and manage the life cycle of the service containers.\nWhen you use a service container for a job or your step uses container actions, you don't need to set port information to access the service. Docker automatically exposes all ports between containers on the same network.\nWhen both the job and the action run in a container, you can directly reference the container by its hostname. The hostname is automatically mapped to the service name.\nWhen a step does not use a container action, you must access the service using localhost and bind the ports.", + "type": "object", + "additionalProperties": { + "$ref": "#/definitions/serviceContainer" + } + }, + "concurrency": { + "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idconcurrency", + "description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. \nYou can also specify concurrency at the workflow level. \nWhen a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. By default any previously pending job or workflow in the concurrency group will be canceled; this behavior can be changed with `queue`. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.", + "oneOf": [ + { + "type": "string" + }, + { + "$ref": "#/definitions/concurrency" + } + ] + } + }, + "required": ["runs-on"], + "additionalProperties": false + }, + "workflowDispatchInput": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_id", + "description": "A string identifier to associate with the input. The value of is a map of the input's metadata. The must be a unique identifier within the inputs object. The must start with a letter or _ and contain only alphanumeric characters, -, or _.", + "type": "object", + "properties": { + "description": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_iddescription", + "description": "A string description of the input parameter.", + "type": "string" + }, + "deprecationMessage": { + "description": "A string shown to users using the deprecated input.", + "type": "string" + }, + "required": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_idrequired", + "description": "A boolean to indicate whether the action requires the input parameter. Set to true when the parameter is required.", + "type": "boolean" + }, + "default": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_iddefault", + "description": "A string representing the default value. The default value is used when an input parameter isn't specified in a workflow file." + }, + "type": { + "$comment": "https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_dispatchinputsinput_idtype", + "description": "A string representing the type of the input.", + "type": "string", + "enum": ["string", "choice", "boolean", "number", "environment"] + }, + "options": { + "$comment": "https://github.blog/changelog/2021-11-10-github-actions-input-types-for-manual-workflows", + "description": "The options of the dropdown list, if the type is a choice.", + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + } + }, + "oneOf": [ + { + "type": "object", + "properties": { + "type": { + "const": "string" + }, + "default": { + "type": "string" + } + }, + "required": ["type"] + }, + { + "type": "object", + "properties": { + "type": { + "const": "boolean" + }, + "default": { + "type": "boolean" + } + }, + "required": ["type"] + }, + { + "type": "object", + "properties": { + "type": { + "const": "number" + }, + "default": { + "type": "number" + } + }, + "required": ["type"] + }, + { + "type": "object", + "properties": { + "type": { + "const": "environment" + }, + "default": { + "type": "string" + } + }, + "required": ["type"] + }, + { + "type": "object", + "properties": { + "type": { + "const": "choice" + }, + "options": { + "$ref": "#/definitions/workflowDispatchInput/properties/options" + } + }, + "required": ["type", "options"] + } + ], + "additionalProperties": false + } + }, + "properties": { + "name": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#name", + "description": "The name of your workflow. GitHub displays the names of your workflows on your repository's actions page. If you omit this field, GitHub sets the name to the workflow's filename.", + "type": "string" + }, + "on": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#on", + "description": "The name of the GitHub event that triggers the workflow. You can provide a single event string, array of events, array of event types, or an event configuration map that schedules a workflow or restricts the execution of a workflow to specific files, tags, or branch changes. For a list of available events, see https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows.", + "oneOf": [ + { + "$ref": "#/definitions/event" + }, + { + "type": "array", + "items": { + "$ref": "#/definitions/event" + }, + "minItems": 1 + }, + { + "type": "object", + "properties": { + "branch_protection_rule": { + "$comment": "https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows#branch_protection_rule", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the branch_protection_rule event occurs. More than one activity type triggers this event.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": ["created", "edited", "deleted"] + }, + "default": ["created", "edited", "deleted"] + } + } + } + ] + }, + "check_run": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#check-run-event-check_run", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the check_run event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/checks/runs.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": [ + "created", + "rerequested", + "completed", + "requested_action" + ] + }, + "default": [ + "created", + "rerequested", + "completed", + "requested_action" + ] + } + } + } + ] + }, + "check_suite": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#check-suite-event-check_suite", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the check_suite event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/checks/suites/.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": ["completed", "requested", "rerequested"] + }, + "default": ["completed", "requested", "rerequested"] + } + } + } + ] + }, + "create": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#create-event-create", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime someone creates a branch or tag, which triggers the create event. For information about the REST API, see https://developer.github.com/v3/git/refs/#create-a-reference." + }, + "delete": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#delete-event-delete", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime someone deletes a branch or tag, which triggers the delete event. For information about the REST API, see https://developer.github.com/v3/git/refs/#delete-a-reference." + }, + "deployment": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#deployment-event-deployment", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime someone creates a deployment, which triggers the deployment event. Deployments created with a commit SHA may not have a Git ref. For information about the REST API, see https://developer.github.com/v3/repos/deployments/." + }, + "deployment_status": { + "$comment": "https://docs.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime a third party provides a deployment status, which triggers the deployment_status event. Deployments created with a commit SHA may not have a Git ref. For information about the REST API, see https://developer.github.com/v3/repos/deployments/#create-a-deployment-status." + }, + "discussion": { + "$comment": "https://docs.github.com/en/actions/reference/events-that-trigger-workflows#discussion", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the discussion event occurs. More than one activity type triggers this event. For information about the GraphQL API, see https://docs.github.com/en/graphql/guides/using-the-graphql-api-for-discussions", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": [ + "created", + "edited", + "deleted", + "transferred", + "pinned", + "unpinned", + "labeled", + "unlabeled", + "locked", + "unlocked", + "category_changed", + "answered", + "unanswered" + ] + }, + "default": [ + "created", + "edited", + "deleted", + "transferred", + "pinned", + "unpinned", + "labeled", + "unlabeled", + "locked", + "unlocked", + "category_changed", + "answered", + "unanswered" + ] + } + } + } + ] + }, + "discussion_comment": { + "$comment": "https://docs.github.com/en/actions/reference/events-that-trigger-workflows#discussion_comment", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the discussion_comment event occurs. More than one activity type triggers this event. For information about the GraphQL API, see https://docs.github.com/en/graphql/guides/using-the-graphql-api-for-discussions", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": ["created", "edited", "deleted"] + }, + "default": ["created", "edited", "deleted"] + } + } + } + ] + }, + "fork": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#fork-event-fork", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime when someone forks a repository, which triggers the fork event. For information about the REST API, see https://developer.github.com/v3/repos/forks/#create-a-fork." + }, + "gollum": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#gollum-event-gollum", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow when someone creates or updates a Wiki page, which triggers the gollum event." + }, + "issue_comment": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#issue-comment-event-issue_comment", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the issue_comment event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/issues/comments/.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": ["created", "edited", "deleted"] + }, + "default": ["created", "edited", "deleted"] + } + } + } + ] + }, + "issues": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#issues-event-issues", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the issues event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/issues.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": [ + "opened", + "edited", + "deleted", + "transferred", + "pinned", + "unpinned", + "closed", + "reopened", + "assigned", + "unassigned", + "labeled", + "unlabeled", + "locked", + "unlocked", + "milestoned", + "demilestoned", + "typed", + "untyped", + "field_added", + "field_removed" + ] + }, + "default": [ + "opened", + "edited", + "deleted", + "transferred", + "pinned", + "unpinned", + "closed", + "reopened", + "assigned", + "unassigned", + "labeled", + "unlabeled", + "locked", + "unlocked", + "milestoned", + "demilestoned", + "typed", + "untyped", + "field_added", + "field_removed" + ] + } + } + } + ] + }, + "label": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#label-event-label", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the label event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/issues/labels/.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": ["created", "edited", "deleted"] + }, + "default": ["created", "edited", "deleted"] + } + } + } + ] + }, + "merge_group": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#merge_group", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow when a pull request is added to a merge queue, which adds the pull request to a merge group. For information about the merge queue, see https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request-with-a-merge-queue .", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": ["checks_requested"] + }, + "default": ["checks_requested"] + } + } + } + ] + }, + "milestone": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#milestone-event-milestone", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the milestone event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/issues/milestones/.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": [ + "created", + "closed", + "opened", + "edited", + "deleted" + ] + }, + "default": [ + "created", + "closed", + "opened", + "edited", + "deleted" + ] + } + } + } + ] + }, + "page_build": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#page-build-event-page_build", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime someone pushes to a GitHub Pages-enabled branch, which triggers the page_build event. For information about the REST API, see https://developer.github.com/v3/repos/pages/." + }, + "project": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#project-event-project", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the project event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/projects/.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": [ + "created", + "updated", + "closed", + "reopened", + "edited", + "deleted" + ] + }, + "default": [ + "created", + "updated", + "closed", + "reopened", + "edited", + "deleted" + ] + } + } + } + ] + }, + "project_card": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#project-card-event-project_card", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the project_card event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/projects/cards.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": [ + "created", + "moved", + "converted", + "edited", + "deleted" + ] + }, + "default": [ + "created", + "moved", + "converted", + "edited", + "deleted" + ] + } + } + } + ] + }, + "project_column": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#project-column-event-project_column", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the project_column event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/projects/columns.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": ["created", "updated", "moved", "deleted"] + }, + "default": ["created", "updated", "moved", "deleted"] + } + } + } + ] + }, + "public": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#public-event-public", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime someone makes a private repository public, which triggers the public event. For information about the REST API, see https://developer.github.com/v3/repos/#edit." + }, + "pull_request": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#pull-request-event-pull_request", + "description": "Runs your workflow anytime the pull_request event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/pulls.\nNote: Workflows do not run on private base repositories when you open a pull request from a forked repository.\nWhen you create a pull request from a forked repository to the base repository, GitHub sends the pull_request event to the base repository and no pull request events occur on the forked repository.\nWorkflows don't run on forked repositories by default. You must enable GitHub Actions in the Actions tab of the forked repository.\nThe permissions for the GITHUB_TOKEN in forked repositories is read-only. For more information about the GITHUB_TOKEN, see https://help.github.com/en/articles/virtual-environments-for-github-actions.", + "oneOf": [ + { + "type": "null" + }, + { + "allOf": [ + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": [ + "assigned", + "unassigned", + "labeled", + "unlabeled", + "opened", + "edited", + "closed", + "reopened", + "synchronize", + "converted_to_draft", + "ready_for_review", + "locked", + "unlocked", + "milestoned", + "demilestoned", + "review_requested", + "review_request_removed", + "auto_merge_enabled", + "auto_merge_disabled", + "enqueued", + "dequeued" + ] + }, + "default": ["opened", "synchronize", "reopened"] + }, + "branches": { + "$ref": "#/definitions/branch" + }, + "branches-ignore": { + "$ref": "#/definitions/branch" + }, + "tags": { + "$ref": "#/definitions/branch" + }, + "tags-ignore": { + "$ref": "#/definitions/branch" + }, + "paths": { + "$ref": "#/definitions/path" + }, + "paths-ignore": { + "$ref": "#/definitions/path" + } + }, + "additionalProperties": false + }, + { + "not": { + "type": "object", + "required": ["branches", "branches-ignore"] + } + }, + { + "not": { + "type": "object", + "required": ["tags", "tags-ignore"] + } + }, + { + "not": { + "type": "object", + "required": ["paths", "paths-ignore"] + } + } + ] + } + ] + }, + "pull_request_review": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#pull-request-review-event-pull_request_review", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the pull_request_review event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/pulls/reviews.\nNote: Workflows do not run on private base repositories when you open a pull request from a forked repository.\nWhen you create a pull request from a forked repository to the base repository, GitHub sends the pull_request event to the base repository and no pull request events occur on the forked repository.\nWorkflows don't run on forked repositories by default. You must enable GitHub Actions in the Actions tab of the forked repository.\nThe permissions for the GITHUB_TOKEN in forked repositories is read-only. For more information about the GITHUB_TOKEN, see https://help.github.com/en/articles/virtual-environments-for-github-actions.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": ["submitted", "edited", "dismissed"] + }, + "default": ["submitted", "edited", "dismissed"] + } + } + } + ] + }, + "pull_request_review_comment": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#pull-request-review-comment-event-pull_request_review_comment", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime a comment on a pull request's unified diff is modified, which triggers the pull_request_review_comment event. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/pulls/comments.\nNote: Workflows do not run on private base repositories when you open a pull request from a forked repository.\nWhen you create a pull request from a forked repository to the base repository, GitHub sends the pull_request event to the base repository and no pull request events occur on the forked repository.\nWorkflows don't run on forked repositories by default. You must enable GitHub Actions in the Actions tab of the forked repository.\nThe permissions for the GITHUB_TOKEN in forked repositories is read-only. For more information about the GITHUB_TOKEN, see https://help.github.com/en/articles/virtual-environments-for-github-actions.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": ["created", "edited", "deleted"] + }, + "default": ["created", "edited", "deleted"] + } + } + } + ] + }, + "pull_request_target": { + "$comment": "https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request_target", + "description": "This event is similar to pull_request, except that it runs in the context of the base repository of the pull request, rather than in the merge commit. This means that you can more safely make your secrets available to the workflows triggered by the pull request, because only workflows defined in the commit on the base repository are run. For example, this event allows you to create workflows that label and comment on pull requests, based on the contents of the event payload.", + "oneOf": [ + { + "type": "null" + }, + { + "allOf": [ + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": [ + "assigned", + "unassigned", + "labeled", + "unlabeled", + "opened", + "edited", + "closed", + "reopened", + "synchronize", + "converted_to_draft", + "ready_for_review", + "locked", + "unlocked", + "review_requested", + "review_request_removed", + "auto_merge_enabled", + "auto_merge_disabled" + ] + }, + "default": ["opened", "synchronize", "reopened"] + }, + "branches": { + "$ref": "#/definitions/branch" + }, + "branches-ignore": { + "$ref": "#/definitions/branch" + }, + "tags": { + "$ref": "#/definitions/branch" + }, + "tags-ignore": { + "$ref": "#/definitions/branch" + }, + "paths": { + "$ref": "#/definitions/path" + }, + "paths-ignore": { + "$ref": "#/definitions/path" + } + }, + "additionalProperties": false + }, + { + "not": { + "type": "object", + "required": ["branches", "branches-ignore"] + } + }, + { + "not": { + "type": "object", + "required": ["tags", "tags-ignore"] + } + }, + { + "not": { + "type": "object", + "required": ["paths", "paths-ignore"] + } + } + ] + } + ] + }, + "push": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#push-event-push", + "description": "Runs your workflow when someone pushes to a repository branch, which triggers the push event.\nNote: The webhook payload available to GitHub Actions does not include the added, removed, and modified attributes in the commit object. You can retrieve the full commit object using the REST API. For more information, see https://developer.github.com/v3/repos/commits/#get-a-single-commit.", + "oneOf": [ + { + "type": "null" + }, + { + "allOf": [ + { + "type": "object", + "properties": { + "branches": { + "$ref": "#/definitions/branch" + }, + "branches-ignore": { + "$ref": "#/definitions/branch" + }, + "tags": { + "$ref": "#/definitions/branch" + }, + "tags-ignore": { + "$ref": "#/definitions/branch" + }, + "paths": { + "$ref": "#/definitions/path" + }, + "paths-ignore": { + "$ref": "#/definitions/path" + } + }, + "additionalProperties": false + }, + { + "not": { + "type": "object", + "required": ["branches", "branches-ignore"] + } + }, + { + "not": { + "type": "object", + "required": ["tags", "tags-ignore"] + } + }, + { + "not": { + "type": "object", + "required": ["paths", "paths-ignore"] + } + } + ] + } + ] + }, + "registry_package": { + "$comment": "https://help.github.com/en/actions/reference/events-that-trigger-workflows#registry-package-event-registry_package", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime a package is published or updated. For more information, see https://help.github.com/en/github/managing-packages-with-github-packages.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": ["published", "updated"] + }, + "default": ["published", "updated"] + } + } + } + ] + }, + "release": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#release-event-release", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the release event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/repos/releases/ in the GitHub Developer documentation.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": [ + "published", + "unpublished", + "created", + "edited", + "deleted", + "prereleased", + "released" + ] + }, + "default": [ + "published", + "unpublished", + "created", + "edited", + "deleted", + "prereleased", + "released" + ] + } + } + } + ] + }, + "status": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#status-event-status", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the status of a Git commit changes, which triggers the status event. For information about the REST API, see https://developer.github.com/v3/repos/statuses/." + }, + "watch": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#watch-event-watch", + "$ref": "#/definitions/eventObject", + "description": "Runs your workflow anytime the watch event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/activity/starring/." + }, + "workflow_call": { + "$comment": "https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows#workflow_call", + "description": "Allows workflows to be reused by other workflows.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "inputs": { + "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#onworkflow_callinputs", + "description": "When using the workflow_call keyword, you can optionally specify inputs that are passed to the called workflow from the caller workflow.", + "type": "object", + "patternProperties": { + "^[_a-zA-Z][a-zA-Z0-9_-]*$": { + "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputsinput_id", + "description": "A string identifier to associate with the input. The value of is a map of the input's metadata. The must be a unique identifier within the inputs object. The must start with a letter or _ and contain only alphanumeric characters, -, or _.", + "type": "object", + "properties": { + "description": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_iddescription", + "description": "A string description of the input parameter.", + "type": "string" + }, + "required": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_idrequired", + "description": "A boolean to indicate whether the action requires the input parameter. Set to true when the parameter is required.", + "type": "boolean" + }, + "type": { + "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onworkflow_callinput_idtype", + "description": "Required if input is defined for the on.workflow_call keyword. The value of this parameter is a string specifying the data type of the input. This must be one of: boolean, number, or string.", + "type": "string", + "enum": ["boolean", "number", "string"] + }, + "default": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_iddefault", + "description": "The default value is used when an input parameter isn't specified in a workflow file.", + "anyOf": [ + { + "type": "boolean" + }, + { + "type": "number" + }, + { + "type": "string" + } + ] + } + }, + "required": ["type"], + "additionalProperties": false + } + }, + "additionalProperties": false + }, + "outputs": { + "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#onworkflow_calloutputs", + "description": "When using the workflow_call keyword, you can optionally specify inputs that are passed to the called workflow from the caller workflow.", + "type": "object", + "patternProperties": { + "^[_a-zA-Z][a-zA-Z0-9_-]*$": { + "$comment": "https://docs.github.com/en/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#outputsoutput_id", + "description": "A string identifier to associate with the output. The value of is a map of the output's metadata. The must be a unique identifier within the outputs object. The must start with a letter or _ and contain only alphanumeric characters, -, or _.", + "type": "object", + "properties": { + "description": { + "$comment": "https://docs.github.com/en/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#outputsoutput_iddescription", + "description": "A string description of the output parameter.", + "type": "string" + }, + "value": { + "$comment": "https://docs.github.com/en/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#outputsoutput_idvalue", + "description": "The value that the output parameter will be mapped to. You can set this to a string or an expression with context. For example, you can use the steps context to set the value of an output to the output value of a step.", + "type": "string" + } + }, + "required": ["value"], + "additionalProperties": false + } + }, + "additionalProperties": false + }, + "secrets": { + "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onworkflow_callsecrets", + "type": "object", + "description": "A map of the secrets that can be used in the called workflow. Within the called workflow, you can use the secrets context to refer to a secret.", + "patternProperties": { + "^[_a-zA-Z][a-zA-Z0-9_-]*$": { + "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onworkflow_callsecretssecret_id", + "type": "object", + "description": "A string identifier to associate with the secret.", + "properties": { + "description": { + "description": "A string description of the secret parameter.", + "type": "string" + }, + "required": { + "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onworkflow_callsecretssecret_idrequired", + "description": "A boolean specifying whether the secret must be supplied.", + "type": "boolean" + } + }, + "additionalProperties": false + } + }, + "additionalProperties": false + } + } + } + ] + }, + "workflow_dispatch": { + "$comment": "https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/", + "$ref": "#/definitions/eventObject", + "description": "You can now create workflows that are manually triggered with the new workflow_dispatch event. You will then see a 'Run workflow' button on the Actions tab, enabling you to easily trigger a run.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "inputs": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputs", + "description": "Input parameters allow you to specify data that the action expects to use during runtime. GitHub stores input parameters as environment variables. Input ids with uppercase letters are converted to lowercase during runtime. We recommended using lowercase input ids.", + "type": "object", + "patternProperties": { + "^[_a-zA-Z][a-zA-Z0-9_-]*$": { + "$ref": "#/definitions/workflowDispatchInput" + } + }, + "additionalProperties": false + } + }, + "additionalProperties": false + } + ] + }, + "workflow_run": { + "$comment": "https://docs.github.com/en/actions/reference/events-that-trigger-workflows#workflow_run", + "$ref": "#/definitions/eventObject", + "description": "This event occurs when a workflow run is requested or completed, and allows you to execute a workflow based on the finished result of another workflow. For example, if your pull_request workflow generates build artifacts, you can create a new workflow that uses workflow_run to analyze the results and add a comment to the original pull request.", + "oneOf": [ + { + "type": "null" + }, + { + "type": "object", + "properties": { + "types": { + "$ref": "#/definitions/types", + "type": "array", + "items": { + "type": "string", + "enum": ["requested", "completed", "in_progress"] + }, + "default": ["requested", "completed"] + }, + "workflows": { + "type": "array", + "items": { + "type": "string" + }, + "minItems": 1 + } + }, + "patternProperties": { + "^branches(-ignore)?$": {} + } + } + ] + }, + "repository_dispatch": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#external-events-repository_dispatch", + "$ref": "#/definitions/eventObject", + "description": "You can use the GitHub API to trigger a webhook event called repository_dispatch when you want to trigger a workflow for activity that happens outside of GitHub. For more information, see https://developer.github.com/v3/repos/#create-a-repository-dispatch-event.\nTo trigger the custom repository_dispatch webhook event, you must send a POST request to a GitHub API endpoint and provide an event_type name to describe the activity type. To trigger a workflow run, you must also configure your workflow to use the repository_dispatch event." + }, + "schedule": { + "$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#schedule", + "description": "You can schedule a workflow to run at specific UTC times using POSIX cron syntax (https://pubs.opengroup.org/onlinepubs/9699919799/utilities/crontab.html#tag_20_25_07). You can optionally specify a timezone using an IANA timezone string (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) for timezone-aware scheduling. Scheduled workflows run on the latest commit on the default or base branch. The shortest interval you can run scheduled workflows is once every 5 minutes.\nNote: GitHub Actions does not support the non-standard syntax @yearly, @monthly, @weekly, @daily, @hourly, and @reboot.\nYou can use crontab guru (https://crontab.guru/) to help generate your cron syntax and confirm what time it will run. To help you get started, there is also a list of crontab guru examples (https://crontab.guru/examples.html).", + "type": "array", + "items": { + "type": "object", + "properties": { + "cron": { + "description": "A cron expression that represents a schedule. A scheduled workflow will run at most once every 5 minutes.", + "type": "string" + }, + "timezone": { + "description": "A string that represents the time zone a scheduled workflow will run relative to in IANA format (e.g. 'America/New_York' or 'Europe/London'). If omitted, the workflow will run relative to midnight UTC.", + "type": "string" + } + }, + "required": ["cron"], + "additionalProperties": false + }, + "minItems": 1 + } + }, + "additionalProperties": false + } + ] + }, + "env": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#env", + "$ref": "#/definitions/env", + "description": "A map of environment variables that are available to all jobs and steps in the workflow." + }, + "defaults": { + "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#defaults", + "$ref": "#/definitions/defaults", + "description": "A map of default settings that will apply to all jobs in the workflow." + }, + "concurrency": { + "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#concurrency", + "description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. \nYou can also specify concurrency at the workflow level. \nWhen a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. By default any previously pending job or workflow in the concurrency group will be canceled; this behavior can be changed with `queue`. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.", + "oneOf": [ + { + "type": "string" + }, + { + "$ref": "#/definitions/concurrency" + } + ] + }, + "cache-mode": { + "$ref": "#/definitions/cacheMode" + }, + "jobs": { + "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobs", + "description": "A workflow run is made up of one or more jobs. Jobs run in parallel by default. To run jobs sequentially, you can define dependencies on other jobs using the jobs..needs keyword.\nEach job runs in a fresh instance of the virtual environment specified by runs-on.\nYou can run an unlimited number of jobs as long as you are within the workflow usage limits. For more information, see https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#usage-limits.", + "type": "object", + "patternProperties": { + "^[_a-zA-Z][a-zA-Z0-9_-]*$": { + "oneOf": [ + { + "$ref": "#/definitions/normalJob" + }, + { + "$ref": "#/definitions/reusableWorkflowCallJob" + } + ] + } + }, + "minProperties": 1, + "additionalProperties": false + }, + "run-name": { + "$comment": "https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#run-name", + "description": "The name for workflow runs generated from the workflow. GitHub displays the workflow run name in the list of workflow runs on your repository's 'Actions' tab.", + "type": "string" + }, + "permissions": { + "$ref": "#/definitions/permissions" + } + }, + "required": ["on", "jobs"], + "type": "object" +} diff --git a/scripts/refresh-github-schemas.mjs b/scripts/refresh-github-schemas.mjs new file mode 100644 index 0000000..fbae5e3 --- /dev/null +++ b/scripts/refresh-github-schemas.mjs @@ -0,0 +1,23 @@ +import fs from 'node:fs' +import path from 'node:path' + +const SCHEMAS_DIR = path.join(import.meta.dirname, '..', 'schemas') + +const SOURCES = { + 'github-workflow.json': 'https://json.schemastore.org/github-workflow.json', + 'github-action.json': 'https://json.schemastore.org/github-action.json', + LICENSE: 'https://raw.githubusercontent.com/SchemaStore/schemastore/master/LICENSE', +} + +async function download(url) { + const response = await fetch(url) + if (!response.ok) throw new Error(`${url}: HTTP ${response.status}`) + return response.text() +} + +for (const [file, url] of Object.entries(SOURCES)) { + const body = await download(url) + if (file.endsWith('.json')) JSON.parse(body) + fs.writeFileSync(path.join(SCHEMAS_DIR, file), body) + process.stdout.write(`${file} ← ${url}\n`) +} diff --git a/src/checks/github-actions.test.ts b/src/checks/github-actions.test.ts new file mode 100644 index 0000000..5e1b48f --- /dev/null +++ b/src/checks/github-actions.test.ts @@ -0,0 +1,205 @@ +import { spawnSync } from 'node:child_process' +import fs from 'node:fs' +import os from 'node:os' +import path from 'node:path' +import { stripVTControlCharacters } from 'node:util' + +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' + +import { runGithubActions } from './github-actions.ts' + +let dir: string +let errorOutput: string[] + +beforeEach(() => { + dir = fs.mkdtempSync(path.join(os.tmpdir(), 'verify-github-actions-')) + errorOutput = [] + vi.spyOn(console, 'log').mockImplementation(() => {}) + vi.spyOn(console, 'error').mockImplementation((...args: unknown[]) => { + errorOutput.push(args.join(' ')) + }) +}) +afterEach(() => { + fs.rmSync(dir, { recursive: true, force: true }) + vi.restoreAllMocks() +}) + +function write(file: string, lines: string[]): void { + const full = path.join(dir, file) + fs.mkdirSync(path.dirname(full), { recursive: true }) + fs.writeFileSync(full, `${lines.join('\n')}\n`) +} + +const output = () => stripVTControlCharacters(errorOutput.join('\n')) + +const VALID_WORKFLOW = [ + 'name: CI', + 'on:', + ' push:', + ' branches: [main]', + ' workflow_dispatch:', + ' inputs:', + ' dry-run:', + ' type: boolean', + ' default: false', + 'jobs:', + ' build:', + ' runs-on: ubuntu-latest', + ' timeout-minutes: 10', + ' steps:', + ' - uses: actions/checkout@v4', + ' - run: npm test', + ' timeout-minutes: ${{ inputs.dry-run && 1 || 5 }}', + ' reuse:', + ' uses: ./.github/workflows/other.yml', + ' secrets: inherit', +] + +const compositeAction = (step: string[]) => [ + 'name: Setup', + 'description: Install dependencies', + 'runs:', + ' using: composite', + ' steps:', + ' - run: npm ci', + ' shell: bash', + ...step, +] + +describe('runGithubActions', () => { + it('skips when there are no workflow or action files', () => { + expect(runGithubActions({ cwd: dir })).toEqual({ name: 'github-actions', ok: true, skipped: true }) + }) + + it('passes valid workflows and composite actions', () => { + write('.github/workflows/ci.yml', VALID_WORKFLOW) + write('.github/actions/setup/action.yml', compositeAction([])) + write('action.yaml', ['name: Root', 'description: d', 'runs:', ' using: node24', ' main: index.js']) + expect(runGithubActions({ cwd: dir })).toEqual({ name: 'github-actions', ok: true }) + }) + + it("passes this repo's own workflows", () => { + expect(runGithubActions({ cwd: path.resolve(import.meta.dirname, '../..') }).ok).toBe(true) + }) + + it('fails on timeout-minutes in a composite action step, naming the file, line and key', () => { + write('.github/actions/setup/action.yml', compositeAction([' - run: npm test', ' shell: bash', ' timeout-minutes: 5'])) + expect(runGithubActions({ cwd: dir }).ok).toBe(false) + expect(output()).toContain('.github/actions/setup/action.yml:10:7 runs.steps[1]: unexpected key "timeout-minutes"') + expect(output()).toContain('Total: 1 problem(s)') + }) + + it('reports errors from the alternative the workflow most likely meant', () => { + write('.github/workflows/ci.yaml', [ + 'on: [push, pul_request]', + 'jobs:', + ' build:', + ' runs-on: ubuntu-latest', + ' bogus: true', + ' steps:', + ' - uses: actions/checkout@v4', + ' run: echo both', + ]) + expect(runGithubActions({ cwd: dir }).ok).toBe(false) + expect(output()).toContain('.github/workflows/ci.yaml:1:12 on[1]: must be equal to one of the allowed values') + expect(output()).toContain('.github/workflows/ci.yaml:5:5 jobs.build: unexpected key "bogus"') + expect(output()).toContain('.github/workflows/ci.yaml:7:9 jobs.build.steps[0]: only one of "uses", "run" is allowed') + expect(output()).toContain('Total: 3 problem(s)') + }) + + it('picks the input type the author declared', () => { + write('.github/workflows/dispatch.yml', [ + 'on:', + ' workflow_dispatch:', + ' inputs:', + ' prerelease:', + " default: 'false'", + ' type: boolean', + 'jobs:', + ' build:', + ' runs-on: ubuntu-latest', + ' steps:', + ' - run: echo', + ]) + expect(runGithubActions({ cwd: dir }).ok).toBe(false) + expect(output()).toContain('dispatch.yml:5:18 on.workflow_dispatch.inputs.prerelease.default: must be boolean') + expect(output()).toContain('Total: 1 problem(s)') + }) + + it('lists every alternative when none fits', () => { + write('.github/workflows/ci.yml', [ + 'on: push', + 'jobs:', + ' a:', + ' runs-on: x', + ' steps:', + ' - run: echo', + ' timeout-minutes: soon', + ]) + expect(runGithubActions({ cwd: dir }).ok).toBe(false) + expect(output()).toContain('ci.yml:7:26 jobs.a.steps[0].timeout-minutes: must be number, or must match pattern') + }) + + it('reports YAML syntax errors with their position', () => { + write('.github/workflows/broken.yml', ['on: push', 'jobs: [', 'x']) + expect(runGithubActions({ cwd: dir }).ok).toBe(false) + expect(output()).toMatch(/\.github\/workflows\/broken\.yml:\d+:\d+ /) + }) +}) + +describe('runGithubActions path filters', () => { + const workflowWithFilters = (filters: string[]) => [ + 'on:', + ...filters, + 'jobs:', + ' build:', + ' runs-on: ubuntu-latest', + ' steps:', + ' - run: echo', + ] + + beforeEach(() => { + write('src/app/index.ts', ['export {}']) + write('src/app/index.test.ts', ['export {}']) + write('docs/guide.md', ['# Guide']) + spawnSync('git', ['init', '-q'], { cwd: dir }) + }) + + it('passes globs that match repository files', () => { + write( + '.github/workflows/ci.yml', + workflowWithFilters([ + ' push:', + " paths: ['src/**', '**.md', 'src/*/index.ts', 'docs/guid?e.md', 'src/[a-z]pp/*']", + ' pull_request:', + " paths-ignore: ['docs/**', '!docs/guide.md']", + ]), + ) + expect(runGithubActions({ cwd: dir }).ok).toBe(true) + }) + + it('fails a glob that matches nothing, naming the workflow and glob', () => { + write('.github/workflows/ci.yml', workflowWithFilters([' push:', ' paths:', " - 'src/**'", " - 'scr/**'"])) + expect(runGithubActions({ cwd: dir }).ok).toBe(false) + expect(output()).toContain('.github/workflows/ci.yml:5:9 on.push.paths[1]: path filter "scr/**" matches no file in the repository') + expect(output()).toContain('Total: 1 problem(s)') + }) + + it('treats a single * as not crossing directories', () => { + write('.github/workflows/ci.yml', workflowWithFilters([' pull_request_target:', " paths-ignore: ['src/*.ts']"])) + expect(runGithubActions({ cwd: dir }).ok).toBe(false) + expect(output()).toContain('on.pull_request_target.paths-ignore[0]: path filter "src/*.ts"') + }) + + it('fails a negated glob that excludes nothing the earlier globs matched', () => { + write('.github/workflows/ci.yml', workflowWithFilters([' push:', " paths: ['src/**', '!src/**.test.ts', '!docs/**']"])) + expect(runGithubActions({ cwd: dir }).ok).toBe(false) + expect(output()).toContain('on.push.paths[2]: path filter "!docs/**"') + expect(output()).toContain('Total: 1 problem(s)') + }) + + it('ignores filters on other events', () => { + write('.github/workflows/ci.yml', workflowWithFilters([' push:', " branches: ['nope/**']", ' workflow_dispatch:'])) + expect(runGithubActions({ cwd: dir }).ok).toBe(true) + }) +}) diff --git a/src/checks/github-actions.ts b/src/checks/github-actions.ts new file mode 100644 index 0000000..4e11a46 --- /dev/null +++ b/src/checks/github-actions.ts @@ -0,0 +1,90 @@ +import { spawnSync } from 'node:child_process' +import fs from 'node:fs' +import path from 'node:path' + +import { color } from '../shared/color.ts' +import { parseYaml, type YamlPosition } from '../shared/yamlLocation.ts' +import { describeError, readablePath, type SchemaKind, validateAgainstSchema } from './githubActionsSchema.ts' +import { findDeadPathFilters } from './githubPathFilter.ts' +import type { CheckResult } from './types.ts' + +const NAME = 'github-actions' + +const YAML_EXT = '.{yml,yaml}' +const WORKFLOW_GLOB = path.posix.join('.github', 'workflows', `*${YAML_EXT}`) +const ACTION_GLOBS = [path.posix.join('.github', 'actions', '**', `action${YAML_EXT}`), `action${YAML_EXT}`] + +type Finding = { file: string; position?: YamlPosition; where?: string; message: string; schemaPath?: string } + +function discover(cwd: string): Array<{ file: string; kind: SchemaKind }> { + const glob = (pattern: string | string[]) => fs.globSync(pattern, { cwd }).map((file) => file.replaceAll('\\', '/')) + return [ + ...glob(WORKFLOW_GLOB).map((file) => ({ file, kind: 'workflow' as const })), + ...glob(ACTION_GLOBS).map((file) => ({ file, kind: 'action' as const })), + ].sort((a, b) => a.file.localeCompare(b.file)) +} + +function listRepoFiles(cwd: string): string[] | undefined { + const result = spawnSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], { + cwd, + encoding: 'utf-8', + maxBuffer: 64 * 1024 * 1024, + }) + if (result.status !== 0) return undefined + return result.stdout.split('\0').filter(Boolean) +} + +function validateFile(cwd: string, file: string, kind: SchemaKind, repoFiles: () => string[] | undefined): Finding[] { + const parsed = parseYaml(fs.readFileSync(path.join(cwd, file), 'utf-8')) + if (parsed.errors.length > 0) return parsed.errors.map(({ message, position }) => ({ file, position, message })) + + const schemaFindings = validateAgainstSchema(kind, parsed.data ?? null).map((error) => { + const unexpectedKey = error.keyword === 'additionalProperties' ? String(error.params.additionalProperty) : undefined + return { + file, + position: parsed.locateNearest(error.instancePath, unexpectedKey), + where: readablePath(error.instancePath), + message: describeError(error), + schemaPath: error.schemaPath, + } + }) + const files = kind === 'workflow' ? repoFiles() : undefined + if (!files) return schemaFindings + const filterFindings = findDeadPathFilters(parsed.data, files).map(({ instancePath, glob }) => ({ + file, + position: parsed.locateNearest(instancePath), + where: readablePath(instancePath), + message: `path filter "${glob}" matches no file in the repository`, + })) + return [...schemaFindings, ...filterFindings] +} + +function formatFinding({ file, position, where, message, schemaPath }: Finding): string { + const location = position ? `${file}:${position.line}:${position.col}` : file + const detail = where ? `${where}: ${message}` : message + return ` ${location} ${detail}${schemaPath ? color.dim(` (${schemaPath})`) : ''}` +} + +export type GithubActionsOptions = { cwd?: string } + +export function runGithubActions(opts: GithubActionsOptions = {}): CheckResult { + const cwd = opts.cwd ?? process.cwd() + const files = discover(cwd) + if (files.length === 0) { + console.log(color.dim(`${NAME}: no workflow or action files — skipping`)) + return { name: NAME, ok: true, skipped: true } + } + + let repoFiles: string[] | undefined | null = null + const getRepoFiles = () => (repoFiles === null ? (repoFiles = listRepoFiles(cwd)) : repoFiles) + const findings = files.flatMap(({ file, kind }) => validateFile(cwd, file, kind, getRepoFiles)) + if (findings.length === 0) { + console.log(color.green(`${files.length} GitHub Actions file(s) valid.`)) + return { name: NAME, ok: true } + } + + console.error(color.red('Invalid GitHub Actions files:\n')) + for (const finding of findings) console.error(formatFinding(finding)) + console.error(color.red(`\nTotal: ${findings.length} problem(s)`)) + return { name: NAME, ok: false } +} diff --git a/src/checks/githubActionsSchema.ts b/src/checks/githubActionsSchema.ts new file mode 100644 index 0000000..9b04092 --- /dev/null +++ b/src/checks/githubActionsSchema.ts @@ -0,0 +1,66 @@ +import fs from 'node:fs' + +import { Ajv, type ErrorObject, type ValidateFunction } from 'ajv' + +import { pointerSegments } from '../shared/yamlLocation.ts' +import { selectRelevantErrors } from './schemaErrorSelection.ts' + +export type SchemaKind = 'workflow' | 'action' + +const schemaFileFromPackageRoot: Record = { + workflow: new URL('../../schemas/github-workflow.json', import.meta.url), + action: new URL('../../schemas/github-action.json', import.meta.url), +} + +type LoadedSchema = { root: unknown; validate: ValidateFunction } + +const loaded = new Map() +let ajv: Ajv | undefined + +function loadSchema(kind: SchemaKind): LoadedSchema { + let schema = loaded.get(kind) + if (!schema) { + ajv ??= new Ajv({ allErrors: true, strict: false, verbose: true }) + const root: unknown = JSON.parse(fs.readFileSync(schemaFileFromPackageRoot[kind], 'utf-8')) + schema = { root, validate: ajv.compile(root as object) } + loaded.set(kind, schema) + } + return schema +} + +function conflictingRequiredKeys(error: ErrorObject): string[] { + const passing = (error.params as { passingSchemas?: unknown }).passingSchemas + if (!Array.isArray(passing) || !Array.isArray(error.schema)) return [] + return passing.flatMap((index: number) => (error.schema as Array<{ required?: string[] }>)[index]?.required ?? []) +} + +export function describeError(error: ErrorObject): string { + const params = error.params as Record + if (error.keyword === 'additionalProperties') return `unexpected key "${String(params.additionalProperty)}"` + const conflicting = error.keyword === 'oneOf' ? conflictingRequiredKeys(error) : [] + if (conflicting.length > 1) return `only one of ${conflicting.map((key) => `"${key}"`).join(', ')} is allowed` + if (error.keyword === 'enum' && Array.isArray(params.allowedValues)) return `${error.message}: ${params.allowedValues.join(', ')}` + return (error.message ?? error.keyword).replaceAll('\r', '\\r').replaceAll('\n', '\\n') +} + +function dedupe(errors: readonly ErrorObject[]): ErrorObject[] { + const seen = new Set() + return errors.filter((error) => { + const id = `${error.instancePath}\0${describeError(error)}` + if (seen.has(id)) return false + seen.add(id) + return true + }) +} + +export function validateAgainstSchema(kind: SchemaKind, data: unknown): ErrorObject[] { + const { root, validate } = loadSchema(kind) + if (validate(data)) return [] + return dedupe(selectRelevantErrors(validate.errors ?? [], root, describeError)) +} + +export function readablePath(instancePath: string): string { + const segments = pointerSegments(instancePath) + if (segments.length === 0) return '(root)' + return segments.reduce((acc, segment) => (/^\d+$/.test(segment) ? `${acc}[${segment}]` : acc ? `${acc}.${segment}` : segment), '') +} diff --git a/src/checks/githubPathFilter.ts b/src/checks/githubPathFilter.ts new file mode 100644 index 0000000..2350356 --- /dev/null +++ b/src/checks/githubPathFilter.ts @@ -0,0 +1,67 @@ +const FILTERED_EVENTS = ['push', 'pull_request', 'pull_request_target'] as const +const FILTER_KEYS = ['paths', 'paths-ignore'] as const + +export type DeadPathFilter = { instancePath: string; glob: string } + +function escapeRegex(char: string): string { + return /[\\^$.|?*+()[\]{}/]/.test(char) ? `\\${char}` : char +} + +function githubFilterToRegex(pattern: string): RegExp { + const tokens: string[] = [] + for (let i = 0; i < pattern.length; i++) { + const char = pattern[i] as string + const previous = tokens.at(-1) + if (char === '\\' && i + 1 < pattern.length) { + tokens.push(escapeRegex(pattern[++i] as string)) + } else if (char === '*') { + const double = pattern[i + 1] === '*' + if (double) i++ + tokens.push(double ? '.*' : '[^/]*') + } else if ((char === '?' || char === '+') && previous !== undefined && !previous.endsWith('*')) { + tokens[tokens.length - 1] = `(?:${previous})${char}` + } else if (char === '[' && pattern.indexOf(']', i + 1) > i + 1) { + const end = pattern.indexOf(']', i + 1) + const members = Array.from(pattern.slice(i + 1, end), (member) => (member === '-' ? member : escapeRegex(member))).join('') + tokens.push(`[${members}]`) + i = end + } else { + tokens.push(escapeRegex(char)) + } + } + return new RegExp(`^${tokens.join('')}$`) +} + +function globsMatchingNothing(patterns: unknown[], files: readonly string[]): Array<{ index: number; glob: string }> { + const dead: Array<{ index: number; glob: string }> = [] + const positives: RegExp[] = [] + patterns.forEach((glob, index) => { + if (typeof glob !== 'string' || glob.includes('${{')) return + const negated = glob.startsWith('!') + const regex = githubFilterToRegex(negated ? glob.slice(1) : glob) + const candidates = negated ? files.filter((file) => positives.some((positive) => positive.test(file))) : files + if (!candidates.some((file) => regex.test(file))) dead.push({ index, glob }) + if (!negated) positives.push(regex) + }) + return dead +} + +function asRecord(value: unknown): Record | undefined { + return value !== null && typeof value === 'object' && !Array.isArray(value) ? (value as Record) : undefined +} + +export function findDeadPathFilters(workflow: unknown, files: readonly string[]): DeadPathFilter[] { + const on = asRecord(asRecord(workflow)?.on) + if (!on) return [] + return FILTERED_EVENTS.flatMap((event) => + FILTER_KEYS.flatMap((key) => { + const raw = asRecord(on[event])?.[key] + const patterns = Array.isArray(raw) ? raw : typeof raw === 'string' ? [raw] : [] + const pointer = `/on/${event}/${key}` + return globsMatchingNothing(patterns, files).map(({ index, glob }) => ({ + instancePath: Array.isArray(raw) ? `${pointer}/${index}` : pointer, + glob, + })) + }), + ) +} diff --git a/src/checks/registry.test.ts b/src/checks/registry.test.ts index 159e2eb..36601ce 100644 --- a/src/checks/registry.test.ts +++ b/src/checks/registry.test.ts @@ -15,6 +15,7 @@ describe('check registry', () => { 'comments', 'hardcoded-colors', 'forbidden-strings', + 'github-actions', 'lint', 'format', 'check-types', @@ -71,6 +72,10 @@ describe('check registry', () => { } }) + it('recommends the github-actions check as a native check', () => { + expect(getCheck('github-actions')).toMatchObject({ kind: 'native', recommended: true, scaffold: { script: 'verifyx github-actions' } }) + }) + it('returns undefined for unknown checks', () => { expect(getCheck('nope')).toBeUndefined() }) diff --git a/src/checks/registry.ts b/src/checks/registry.ts index 67ae623..642c1d3 100644 --- a/src/checks/registry.ts +++ b/src/checks/registry.ts @@ -5,6 +5,7 @@ import { runComments } from './comments.ts' import { runComplexity } from './complexity.ts' import { defineExternalCheck } from './external.ts' import { runForbiddenStrings } from './forbidden-strings.ts' +import { runGithubActions } from './github-actions.ts' import { runHardcodedColors } from './hardcoded-colors.ts' import { jscpdCount } from './maxWarnings.ts' import { typeCheckCommand, typeCheckPreflight } from './tsconfig.ts' @@ -34,6 +35,7 @@ export const CHECKS: Check[] = [ ), nativeCheck('hardcoded-colors', 'Fail on literal hex / 0x colour values in source', false, () => runHardcodedColors()), nativeCheck('forbidden-strings', 'Fail on disallowed JSON config values (rules from verify config)', false, () => runForbiddenStrings()), + nativeCheck('github-actions', 'Schema-validate GitHub Actions workflows and composite/action metadata', true, () => runGithubActions()), defineExternalCheck({ name: 'lint', description: 'Lint — auto-fixes locally, checks in CI', diff --git a/src/checks/schemaErrorSelection.ts b/src/checks/schemaErrorSelection.ts new file mode 100644 index 0000000..3bf6a38 --- /dev/null +++ b/src/checks/schemaErrorSelection.ts @@ -0,0 +1,133 @@ +import type { ErrorObject } from 'ajv' + +import { pointerSegments } from '../shared/yamlLocation.ts' + +type Schema = unknown +type SchemaObject = Record + +const KIND_MISMATCH_KEYWORDS = new Set(['type', 'const', 'enum', 'pattern']) +const SAME_INSTANCE_KEYWORDS = ['allOf', 'anyOf', 'oneOf', 'not', 'if', 'then', 'else'] + +const isObject = (value: unknown): value is SchemaObject => !!value && typeof value === 'object' +const asList = (value: Schema): Schema[] => (Array.isArray(value) ? value : value === undefined ? [] : [value]) +const escapeSegment = (segment: string) => segment.replaceAll('~', '~0').replaceAll('/', '~1') + +function resolveLocalRef(root: Schema, ref: string): Schema { + if (!ref.startsWith('#')) return undefined + return pointerSegments(decodeURIComponent(ref.slice(1))).reduce( + (node, segment) => (isObject(node) ? node[segment] : undefined), + root, + ) +} + +function matchesPattern(pattern: string, key: string): boolean { + try { + return new RegExp(pattern, 'u').test(key) + } catch { + return false + } +} + +function childInstances(schema: SchemaObject, data: unknown): Array<{ schema: Schema; data: unknown; segment: string }> { + if (Array.isArray(data)) + return data.flatMap((item, i) => asList(schema.items).map((items) => ({ schema: items, data: item, segment: String(i) }))) + if (!isObject(data)) return [] + const properties = isObject(schema.properties) ? schema.properties : {} + const patterns = Object.entries(isObject(schema.patternProperties) ? schema.patternProperties : {}) + return Object.entries(data).flatMap(([key, value]) => { + const matched = [properties[key], ...patterns.filter(([pattern]) => matchesPattern(pattern, key)).map(([, s]) => s)] + const dependency = isObject(schema.dependencies) ? schema.dependencies[key] : undefined + return [...matched, schema.additionalProperties] + .filter(isObject) + .map((child) => ({ schema: child, data: value, segment: escapeSegment(key) })) + .concat(isObject(dependency) ? [{ schema: dependency, data, segment: '' }] : []) + }) +} + +function collectApplications(schema: Schema, data: unknown, instancePath: string, root: Schema, out: Map>): void { + if (!isObject(schema)) return + const paths = out.get(schema) ?? new Set() + if (paths.has(instancePath)) return + out.set(schema, paths.add(instancePath)) + const sameInstance = [ + typeof schema.$ref === 'string' ? resolveLocalRef(root, schema.$ref) : undefined, + ...SAME_INSTANCE_KEYWORDS.flatMap((k) => asList(schema[k])), + ] + for (const sub of sameInstance) collectApplications(sub, data, instancePath, root, out) + for (const child of childInstances(schema, data)) { + collectApplications(child.schema, child.data, child.segment ? `${instancePath}/${child.segment}` : instancePath, root, out) + } +} + +function branchApplications(branch: Schema, combinator: ErrorObject, root: Schema): Map> { + const applications = new Map>() + collectApplications(branch, combinator.data, combinator.instancePath, root, applications) + return applications +} + +function groupByBranch(combinator: ErrorObject, errors: ErrorObject[], root: Schema) { + const branches = asList(combinator.schema).map((branch) => branchApplications(branch, combinator, root)) + const groups: ErrorObject[][] = branches.map(() => []) + const unassigned: ErrorObject[] = [] + let branchIndex = 0 + const owns = (index: number, error: ErrorObject) => !!branches[index]?.get(error.parentSchema as object)?.has(error.instancePath) + for (const error of errors) { + let index = branchIndex + while (index < branches.length && !owns(index, error)) index++ + if (index === branches.length) { + unassigned.push(error) + continue + } + branchIndex = index + groups[index]?.push(error) + } + return { groups: groups.filter((group) => group.length > 0), unassigned } +} + +const depth = (error: ErrorObject) => pointerSegments(error.instancePath).length + +const branchScore = (group: ErrorObject[]) => [ + group.filter((error) => error.keyword === 'const').length, + group.length, + -Math.max(...group.map(depth)), +] + +function isBetterScore(score: number[], best: number[]): boolean { + const index = score.findIndex((value, i) => value !== best[i]) + return index >= 0 && (score[index] as number) < (best[index] as number) +} + +const closestBranch = (branches: ErrorObject[][]): ErrorObject[] => + branches.reduce((best, group) => (isBetterScore(branchScore(group), branchScore(best)) ? group : best)) + +function pickBranchErrors( + combinator: ErrorObject, + errors: ErrorObject[], + root: Schema, + describe: (e: ErrorObject) => string, +): ErrorObject[] { + const { groups, unassigned } = groupByBranch(combinator, errors, root) + if (groups.length === 0) return [...unassigned, combinator] + const isKindMismatch = (error: ErrorObject) => KIND_MISMATCH_KEYWORDS.has(error.keyword) && error.instancePath === combinator.instancePath + const fitting = groups.filter((group) => !group.some(isKindMismatch)) + if (fitting.length > 0) return [...unassigned, ...closestBranch(fitting)] + const alternatives = [...new Set(groups.flat().filter(isKindMismatch).map(describe))] + return [...unassigned, { ...combinator, keyword: 'alternatives', message: alternatives.join(', or ') }] +} + +const isAtOrBelow = (error: ErrorObject, instancePath: string) => + error.instancePath === instancePath || error.instancePath.startsWith(`${instancePath}/`) + +export function selectRelevantErrors(errors: readonly ErrorObject[], root: Schema, describe: (e: ErrorObject) => string): ErrorObject[] { + const selected: ErrorObject[] = [] + for (const error of errors) { + if (error.keyword !== 'oneOf' && error.keyword !== 'anyOf') { + selected.push(error) + continue + } + let start = selected.length + while (start > 0 && isAtOrBelow(selected[start - 1] as ErrorObject, error.instancePath)) start-- + selected.push(...pickBranchErrors(error, selected.splice(start), root, describe)) + } + return selected +} diff --git a/src/commands/registerChecks.ts b/src/commands/registerChecks.ts index 0217b05..886c3ca 100644 --- a/src/commands/registerChecks.ts +++ b/src/commands/registerChecks.ts @@ -3,6 +3,7 @@ import { type Command, InvalidArgumentError } from 'commander' import { runComments } from '../checks/comments.ts' import { runComplexity } from '../checks/complexity.ts' import { runForbiddenStrings } from '../checks/forbidden-strings.ts' +import { runGithubActions } from '../checks/github-actions.ts' import { runHardcodedColors } from '../checks/hardcoded-colors.ts' import { CHECKS } from '../checks/registry.ts' @@ -77,6 +78,13 @@ export function registerChecks(program: Command): void { finish(runForbiddenStrings().ok) }) + program + .command('github-actions') + .description('Schema-validate GitHub Actions workflows and composite/action metadata') + .action(() => { + finish(runGithubActions().ok) + }) + // Mode flows via the VERIFY_MODE env / CI, not per-subcommand flags (which collide with the root's --check). for (const check of CHECKS.filter((c) => c.kind === 'external')) { const command = program diff --git a/src/index.ts b/src/index.ts index d91b1a8..f94b59d 100644 --- a/src/index.ts +++ b/src/index.ts @@ -12,6 +12,7 @@ export { export { type CommentsOptions, runComments } from './checks/comments.ts' export { runComplexity } from './checks/complexity.ts' export { runForbiddenStrings } from './checks/forbidden-strings.ts' +export { type GithubActionsOptions, runGithubActions } from './checks/github-actions.ts' export { runHardcodedColors } from './checks/hardcoded-colors.ts' export { CHECKS, getCheck, recommendedChecks } from './checks/registry.ts' export type { Check, CheckKind, CheckMode, CheckResult, RunDefaultOptions } from './checks/types.ts' diff --git a/src/shared/yamlLocation.ts b/src/shared/yamlLocation.ts new file mode 100644 index 0000000..e07533a --- /dev/null +++ b/src/shared/yamlLocation.ts @@ -0,0 +1,56 @@ +import { isMap, isScalar, isSeq, LineCounter, type Node, parseDocument } from 'yaml' + +export type YamlPosition = { line: number; col: number } + +export type ParsedYaml = { + data: unknown + errors: Array<{ message: string; position?: YamlPosition }> + locateNearest: (instancePath: string, key?: string) => YamlPosition | undefined +} + +export function pointerSegments(instancePath: string): string[] { + if (!instancePath) return [] + return instancePath + .slice(1) + .split('/') + .map((segment) => segment.replaceAll('~1', '/').replaceAll('~0', '~')) +} + +function child(node: unknown, segment: string): { key?: Node; value?: Node } | undefined { + if (isMap(node)) { + const pair = node.items.find((item) => isScalar(item.key) && String(item.key.value) === segment) + return pair ? { key: pair.key as Node, value: (pair.value ?? undefined) as Node | undefined } : undefined + } + if (isSeq(node)) { + const item = node.items[Number(segment)] + return item ? { value: item as Node } : undefined + } + return undefined +} + +function findNearestNode(root: unknown, segments: string[], key?: string): Node | undefined { + let current = root as Node | undefined + for (const segment of segments) { + const next = child(current, segment) + if (!next?.value) return next?.key ?? current + current = next.value + } + return (key === undefined ? undefined : child(current, key)?.key) ?? current +} + +export function parseYaml(text: string): ParsedYaml { + const lineCounter = new LineCounter() + const doc = parseDocument(text, { lineCounter }) + const toPosition = (offset: number): YamlPosition => lineCounter.linePos(offset) + return { + data: doc.errors.length ? undefined : doc.toJS({ maxAliasCount: -1 }), + errors: doc.errors.map((error) => ({ + message: (error.message.split('\n')[0] ?? error.message).replace(/ at line \d+, column \d+:?$/, ''), + position: toPosition(error.pos[0]), + })), + locateNearest: (instancePath, key) => { + const range = findNearestNode(doc.contents, pointerSegments(instancePath), key)?.range + return range ? toPosition(range[0]) : undefined + }, + } +} From 248cbb092126b7316e90bbe83aa3eb75cf0c3f1c Mon Sep 17 00:00:00 2001 From: Stafford Williams Date: Thu, 8 Oct 2026 14:41:09 +1100 Subject: [PATCH 2/3] fix: let **/ match zero directories --- src/checks/github-actions.test.ts | 10 ++++++++++ src/checks/githubPathFilter.ts | 11 +++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/src/checks/github-actions.test.ts b/src/checks/github-actions.test.ts index 5e1b48f..8ff27ab 100644 --- a/src/checks/github-actions.test.ts +++ b/src/checks/github-actions.test.ts @@ -178,6 +178,16 @@ describe('runGithubActions path filters', () => { expect(runGithubActions({ cwd: dir }).ok).toBe(true) }) + it('lets **/ match zero directories', () => { + write('package.json', ['{}']) + write('src/index.ts', ['export {}']) + write( + '.github/workflows/ci.yml', + workflowWithFilters([' push:', " paths: ['**/package.json', 'src/**/index.ts', 'src/**/app/*.ts']"]), + ) + expect(runGithubActions({ cwd: dir }).ok).toBe(true) + }) + it('fails a glob that matches nothing, naming the workflow and glob', () => { write('.github/workflows/ci.yml', workflowWithFilters([' push:', ' paths:', " - 'src/**'", " - 'scr/**'"])) expect(runGithubActions({ cwd: dir }).ok).toBe(false) diff --git a/src/checks/githubPathFilter.ts b/src/checks/githubPathFilter.ts index 2350356..bed0b7c 100644 --- a/src/checks/githubPathFilter.ts +++ b/src/checks/githubPathFilter.ts @@ -16,8 +16,15 @@ function githubFilterToRegex(pattern: string): RegExp { tokens.push(escapeRegex(pattern[++i] as string)) } else if (char === '*') { const double = pattern[i + 1] === '*' - if (double) i++ - tokens.push(double ? '.*' : '[^/]*') + if (!double) { + tokens.push('[^/]*') + } else if (pattern[i + 2] === '/') { + tokens.push('(?:.*/)?') + i += 2 + } else { + tokens.push('.*') + i++ + } } else if ((char === '?' || char === '+') && previous !== undefined && !previous.endsWith('*')) { tokens[tokens.length - 1] = `(?:${previous})${char}` } else if (char === '[' && pattern.indexOf(']', i + 1) > i + 1) { From c13ac90ff2e43b63f2aff550a9d35e7223b0d33e Mon Sep 17 00:00:00 2001 From: Stafford Williams Date: Thu, 8 Oct 2026 14:43:24 +1100 Subject: [PATCH 3/3] fix: check negations against included --- src/checks/github-actions.test.ts | 7 +++++++ src/checks/githubPathFilter.ts | 11 +++++++---- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/src/checks/github-actions.test.ts b/src/checks/github-actions.test.ts index 8ff27ab..b748b94 100644 --- a/src/checks/github-actions.test.ts +++ b/src/checks/github-actions.test.ts @@ -208,6 +208,13 @@ describe('runGithubActions path filters', () => { expect(output()).toContain('Total: 1 problem(s)') }) + it('checks each negation against files still included after earlier negations', () => { + write('.github/workflows/ci.yml', workflowWithFilters([' push:', " paths: ['src/**', '!src/**', '!src/app/**']"])) + expect(runGithubActions({ cwd: dir }).ok).toBe(false) + expect(output()).toContain('on.push.paths[2]: path filter "!src/app/**"') + expect(output()).toContain('Total: 1 problem(s)') + }) + it('ignores filters on other events', () => { write('.github/workflows/ci.yml', workflowWithFilters([' push:', " branches: ['nope/**']", ' workflow_dispatch:'])) expect(runGithubActions({ cwd: dir }).ok).toBe(true) diff --git a/src/checks/githubPathFilter.ts b/src/checks/githubPathFilter.ts index bed0b7c..361f0f1 100644 --- a/src/checks/githubPathFilter.ts +++ b/src/checks/githubPathFilter.ts @@ -41,14 +41,17 @@ function githubFilterToRegex(pattern: string): RegExp { function globsMatchingNothing(patterns: unknown[], files: readonly string[]): Array<{ index: number; glob: string }> { const dead: Array<{ index: number; glob: string }> = [] - const positives: RegExp[] = [] + const included = new Set() patterns.forEach((glob, index) => { if (typeof glob !== 'string' || glob.includes('${{')) return const negated = glob.startsWith('!') const regex = githubFilterToRegex(negated ? glob.slice(1) : glob) - const candidates = negated ? files.filter((file) => positives.some((positive) => positive.test(file))) : files - if (!candidates.some((file) => regex.test(file))) dead.push({ index, glob }) - if (!negated) positives.push(regex) + const matches = (negated ? [...included] : files).filter((file) => regex.test(file)) + if (matches.length === 0) dead.push({ index, glob }) + for (const file of matches) { + if (negated) included.delete(file) + else included.add(file) + } }) return dead }