Skip to content

Commit 1764c28

Browse files
erikburterikburt
authored
feat: populate workflows (#1)
* feat: populate workflows * docs: populate readme
1 parent def9d57 commit 1764c28

File tree

5 files changed

+254
-1
lines changed

5 files changed

+254
-1
lines changed

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @smartcontractkit/devex-cicd

‎.github/workflows/codeowners-validation.yml‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
name: "CodeOwners Validation"
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
# This job is necessary because the org-wide rulesets don't support event-based path filtering.
8+
# (https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#running-your-pull_request-workflow-based-on-files-changed-in-a-pull-request)
9+
# We include this job to filter the paths manually.
10+
filter-changes:
11+
name: Filter changes
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
pull-requests: read
16+
outputs:
17+
codeowners: ${{ steps.filter.outputs.codeowners }}
18+
steps:
19+
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
20+
id: filter
21+
with:
22+
filters: |
23+
codeowners:
24+
- ".github/CODEOWNERS"
25+
- "CODEOWNERS"
26+
27+
validate-codeowners:
28+
name: "Validate"
29+
runs-on: ubuntu-latest
30+
needs: filter-changes
31+
permissions:
32+
contents: read
33+
id-token: write
34+
if: ${{ needs.filter-changes.outputs.codeowners == 'true' }}
35+
steps:
36+
- uses: actions/checkout@v4
37+
with:
38+
fetch-depth: 1
39+
persist-credentials: false
40+
41+
- name: Setup GitHub Token
42+
id: gh-token
43+
uses: smartcontractkit/.github/actions/setup-github-token@main
44+
with:
45+
aws-role-arn: ${{ secrets.GATI_CODEOWNERS_IAM_ARN }}
46+
aws-lambda-url: ${{ secrets.GATI_CODEOWNERS_LAMBDA_URL }}
47+
aws-region: "us-west-2"
48+
49+
- name: GitHub CODEOWNERS Validator
50+
uses: patrickhuie19/codeowners-validator@176f0bfd300c754c6cc8d4a9e9863323e6752b90 # v0.1.8
51+
with:
52+
github_access_token: ${{ steps.gh-token.outputs.access-token }}
53+
repository_path: ${{ github.workspace }}
54+
owner_checker_repository: ${{ github.repository }}
55+
56+
# List of validation checks to execute (comma-separated)
57+
# Available: files, owners, duppatterns, syntax, patterns
58+
checks: "files,owners,duppatterns,syntax,patterns"
59+
60+
# List of experimental validation checks (comma-separated)
61+
# Available: notowned, avoid-shadowing
62+
# Note: 'notowned' is disabled pending arm64 support
63+
experimental_checks: "avoid-shadowing"
64+
65+
# Failure level for check issues
66+
# Available: error, warning (default: warning)
67+
check_failure_level: "error"
68+
69+
# Patterns to ignore in not-owned-checker (comma-separated)
70+
# Example: Use "*" to ignore global ownership patterns
71+
not_owned_checker_skip_patterns: ""
72+
73+
# Owners to exclude from validation (comma-separated)
74+
# Format: @owner, @org/team, email@example.com
75+
owner_checker_ignored_owners: "@ghost"
76+
77+
# Whether to allow files without explicit owners
78+
owner_checker_allow_unowned_patterns: "false"
79+
80+
# Enforce team-only ownership
81+
owner_checker_owners_must_be_teams: "true"
82+
83+
# Specific subdirectories to check for ownership
84+
not_owned_checker_subdirectories: ""
85+
86+
# Patterns to exclude from validation (comma-separated)
87+
pattern_checker_ignored_patterns: ""
88+
89+
- name: Print Summary
90+
if: always()
91+
run: |
92+
cat <<'EOF' >> $GITHUB_STEP_SUMMARY
93+
## CODEOWNERS Validation Guidelines
94+
95+
<details>
96+
<summary>🔍 Pattern Order Issues</summary>
97+
98+
* Ensure patterns are ordered from least specific to most specific.
99+
* More general paths must come BEFORE more specific ones.
100+
* Example:
101+
```
102+
# ✅ Correct order (general to specific)
103+
* @org/core-team # Most general
104+
/docs/* @org/docs-team # More specific
105+
/docs/api/* @org/api-team # Most specific
106+
107+
# ❌ Incorrect order (causes shadowing)
108+
/docs/api/* @org/api-team # Specific pattern shadows general ones
109+
/docs/* @org/docs-team # Never matches due to shadowing
110+
* @org/core-team # Never matches due to shadowing
111+
```
112+
</details>
113+
114+
<details>
115+
<summary>🔍 Duplicate Patterns</summary>
116+
117+
* Verify that each pattern is defined only once.
118+
* Remove duplicate definitions to prevent inconsistent ownership.
119+
* Use your editor's search (e.g. git grep) to locate duplicates.
120+
</details>
121+
122+
<details>
123+
<summary>🔍 Non-Existent Paths</summary>
124+
125+
* Review patterns that do not match any files in the repository.
126+
* Check paths for typos or changes in repository structure.
127+
* Remove patterns referencing deleted files or directories.
128+
</details>
129+
130+
<details>
131+
<summary>🔍 Discrete File Issues</summary>
132+
133+
* Warnings like "Discrete file" indicate patterns match a single file.
134+
* Discrete file patterns are hard to maintain, and also indicate a lack of shared knowledge.
135+
* Verify if the specific file path is intended.
136+
* If not, update the pattern to target the correct file(s).
137+
</details>
138+
139+
<details>
140+
<summary>🔍 Deeply Nested Pattern Issues</summary>
141+
142+
* "Deeply nested pattern" warnings suggest patterns may be too specific.
143+
* This error occurs when the path contains more than 3 levels of nesting.
144+
* Consider simplifying patterns to improve maintainability.
145+
* Check if excessive nesting is necessary or if a broader pattern could suffice.
146+
</details>
147+
148+
<details>
149+
<summary>🔍 Owner Issues</summary>
150+
151+
* Every pattern must have at least one owner.
152+
* Replace individual users with team mentions where required.
153+
* Remove multiple owner declarations; consolidate into the relevant team.
154+
* Ensure only team owners are used if that rule is enforced.
155+
</details>
156+
157+
<details>
158+
<summary>🔍 Best Practices</summary>
159+
160+
1. Use team mentions instead of individual accounts.
161+
2. Keep patterns simple and maintainable.
162+
3. Regularly update and clean up ownership patterns.
163+
4. Use wildcards sparingly and only when necessary.
164+
5. Document any special cases with inline comments.
165+
</details>
166+
167+
<details>
168+
<summary>Example of a Well-Structured CODEOWNERS</summary>
169+
170+
```
171+
# Core application
172+
* @org/core-team
173+
174+
# Documentation
175+
docs/* @org/docs-team
176+
177+
# Specific features
178+
src/features/auth/* @org/security-team
179+
src/features/api/* @org/api-team
180+
```
181+
</details>
182+
EOF

‎.github/workflows/gha-workflow-validation.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: GHA Workflow Validation
2+
3+
on:
4+
pull_request:
5+
merge_group:
6+
7+
jobs:
8+
validate-workflows:
9+
name: Validate Workflow Changes
10+
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
13+
pull-requests: write
14+
# Skip on merge group events
15+
if: ${{ github.event_name == 'pull_request' }}
16+
steps:
17+
- name: Checkout Repo
18+
uses: actions/checkout@v4
19+
with:
20+
fetch-depth: 1
21+
persist-credentials: false
22+
23+
- name: Run gha-workflow-validator action
24+
uses: smartcontractkit/.github/actions/gha-workflow-validator@782f2ba4d8fa36a9d214b791b4938259875e1412 # gha-workflow-validator@0.5.0
25+
env:
26+
GITHUB_TOKEN: ${{ github.token }}

‎.github/workflows/go-mod-validation.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: Validate Go Mod Files
2+
3+
on:
4+
pull_request:
5+
merge_group:
6+
7+
jobs:
8+
go-mod-validation:
9+
name: Validate go.mod dependencies
10+
runs-on: ubuntu-latest
11+
# Skip on merge group events
12+
if: ${{ github.event_name == 'pull_request' }}
13+
steps:
14+
- uses: actions/checkout@v4
15+
16+
- name: Validate go.mod
17+
uses: smartcontractkit/.github/apps/go-mod-validator@go-mod-validator/0.5.2

‎README.md‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,29 @@
11
# gha-org-workflows
2-
Org-wide Github Actions (GHA) workflows for smarcontractkit.
2+
3+
Org-wide Github Actions (GHA) workflows for [smartcontractkit](https://github.com/smartcontractkit).
4+
5+
## Workflows
6+
7+
### Go Mod Validation
8+
9+
Uses [`go-mod-validator`](https://github.com/smartcontractkit/.github/tree/main/apps/go-mod-validator) action.
10+
* For all go.mod files within a repository, filtered by a given prefix, this action validates that each dependency is on the default branch of the upstream repository.
11+
12+
13+
### GHA Workflow Validator
14+
15+
Uses [`gha-workflow-validator`](https://github.com/smartcontractkit/.github/tree/main/actions/gha-workflow-validator) action.
16+
* Validates changes to Github Actions workflows. Things like:
17+
* Ensuring 3rd-party Github Actions are pinned to SHA refs.
18+
* Checking for outdated dependencies.
19+
* Limiting usage of high-cost runners.
20+
21+
### CODEOWNERS Validation
22+
23+
Uses [patrickhuie19/codeowners-validator](https://github.com/patrickhuie19/codeowners-validator/) action.
24+
* Validates the contents of a CODEOWNERS file when it is modified. Enforces certain criteria to ensure healthy CODEOWNERS.
25+
26+
27+
## Help
28+
29+
If you are experiencing a blocking error from a workflow in this repository, please reach out to us on `#team-devex`.

0 commit comments

Comments
 (0)