diff --git a/.github/workflows/CHANGELOGS/run_gha_checks.md b/.github/workflows/CHANGELOGS/run_gha_checks.md index 6153942..2a1de84 100644 --- a/.github/workflows/CHANGELOGS/run_gha_checks.md +++ b/.github/workflows/CHANGELOGS/run_gha_checks.md @@ -2,6 +2,14 @@ All notable changes to the **run_gha_checks** reusable workflow are documented in this file. +## 1.0.3 + +### Fixed + +- The `baselined` output counts only real inline directives (`# zizmor: ignore[...]` in YAML files + under `.github`), and counts each one rather than each line. Names in documentation, changelogs + and test fixtures inflated the count. + ## 1.0.2 ### Changed diff --git a/.github/workflows/CHANGELOGS/run_js_checks.md b/.github/workflows/CHANGELOGS/run_js_checks.md index 0df4631..7847335 100644 --- a/.github/workflows/CHANGELOGS/run_js_checks.md +++ b/.github/workflows/CHANGELOGS/run_js_checks.md @@ -2,6 +2,14 @@ All notable changes to the **run_js_checks** reusable workflow are documented in this file. +## 1.0.2 + +### Fixed + +- The `baselined` output counts only real inline directives (`//` or `/*` `eslint-disable…` and + `prettier-ignore` comments in JS and TS files), and counts each one rather than each line. Names + in documentation, changelogs and test fixtures inflated the count. + ## 1.0.1 ### Changed diff --git a/.github/workflows/CHANGELOGS/run_markdown_checks.md b/.github/workflows/CHANGELOGS/run_markdown_checks.md index da03245..b7703e4 100644 --- a/.github/workflows/CHANGELOGS/run_markdown_checks.md +++ b/.github/workflows/CHANGELOGS/run_markdown_checks.md @@ -2,6 +2,14 @@ All notable changes to the **run_markdown_checks** reusable workflow are documented in this file. +## 1.0.2 + +### Fixed + +- The `baselined` output counts only real inline directives (`\ntext\n\n', - 'docs/guide.md': '\n', + 'docs/guide.md': + '\n
\n', + }); + + expect(result.status).toBe(0); + expect(result.outputs.count).toBe('5'); + }); + + test("doesn't count the directive name in prose, inline code, other files or .core-services", () => { + const result = count({ + 'README.md': 'Use `` sparingly; markdownlint-disable is baselined.\n', + 'CHANGELOG.md': '- Counts inline `markdownlint-disable` comments.\n', '.core-services/standard.md': '\n', - 'notes.txt': 'markdownlint-disable is not counted outside Markdown\n', + 'notes.txt': '\n', + 'test.js': "const fixture = '';\n", [`.github/workflows/${workflowFile}`]: readWorkflow(workflowFile), }); expect(result.status).toBe(0); - expect(result.outputs.count).toBe('3'); + expect(result.outputs.count).toBe('0'); }); }); diff --git a/.github/workflows/TESTS/run_repo_checks.unit.test.js b/.github/workflows/TESTS/run_repo_checks.unit.test.js index 2951e24..d888d98 100644 --- a/.github/workflows/TESTS/run_repo_checks.unit.test.js +++ b/.github/workflows/TESTS/run_repo_checks.unit.test.js @@ -165,6 +165,37 @@ describe('run_repo_checks Summary', () => { expect(result.summary).toContain('**Standard:** ❌ fail'); }); + test('shows a setup failure when a failed job skipped steps without a failing one', () => { + const result = summarize({ + detect: detected({ 'markdown-files': '74', 'js-files': '27', 'terraform-files': '3' }), + gha: skipped, + terraform: { + result: 'failure', + outputs: { + init: 'skipped', + validate: 'skipped', + lint: 'skipped', + format: 'skipped', + scan: 'skipped', + baselined: '0', + }, + }, + markdown: { result: 'failure', outputs: { lint: 'skipped', baselined: '0' } }, + shell: skipped, + js: { result: 'failure', outputs: { lint: 'skipped', format: 'skipped', baselined: '0' } }, + standard: { result: 'success', outputs: { result: 'success' } }, + }); + + expect(result.status).toBe(0); + expect(result.summary).toContain( + '| Terraform | 3 | ❌ setup failed | ❌ setup failed | ❌ setup failed | ❌ setup failed | ❌ setup failed | 0 |' + ); + expect(result.summary).toContain('| Markdown | 74 | — | — | ❌ setup failed | — | — | 0 |'); + expect(result.summary).toContain( + '| JavaScript/TypeScript | 27 | — | — | ❌ setup failed | ❌ setup failed | — | 0 |' + ); + }); + test('marks every technology unknown when Detect failed', () => { const result = summarize({ detect: { result: 'failure', outputs: {} }, diff --git a/.github/workflows/TESTS/run_shell_checks.unit.test.js b/.github/workflows/TESTS/run_shell_checks.unit.test.js index 74aaae3..ba74341 100644 --- a/.github/workflows/TESTS/run_shell_checks.unit.test.js +++ b/.github/workflows/TESTS/run_shell_checks.unit.test.js @@ -6,19 +6,25 @@ describe('run_shell_checks baselined count', () => { const count = files => runStepInRepository(workflowFile, 'checks', 'Count baselined issues', files); - test('counts inline shellcheck disables in any tracked file outside .core-services', () => { + test('counts each inline shellcheck disable directive in scripts and workflow run blocks', () => { const result = count({ 'scripts/deploy.sh': '#!/bin/bash\n# shellcheck disable=SC2086\necho $1\n', - 'scripts/tool': '#!/usr/bin/env bash\n# shellcheck disable=SC2034,SC2154\n', - '.core-services/generated/hook.sh': '# shellcheck disable=SC1091\n', + 'scripts/tool': '#!/usr/bin/env bash\n#shellcheck disable=SC2034,SC2154\n', + '.github/workflows/ci.yml': ' run: |\n # shellcheck disable=SC2016\n', }); expect(result.status).toBe(0); - expect(result.outputs.count).toBe('2'); + expect(result.outputs.count).toBe('3'); }); - test("doesn't count its own pattern", () => { - const result = count({ [`.github/workflows/${workflowFile}`]: readWorkflow(workflowFile) }); + test("doesn't count the directive in docs, strings, .core-services or its own pattern", () => { + const result = count({ + 'README.md': '# shellcheck disable=SC2086\n', + 'CHANGELOG.md': '- Counts inline `# shellcheck disable=` directives.\n', + 'test/a.test.js': "const script = '#!/bin/bash\\n# shellcheck disable=SC2086\\n';\n", + '.core-services/generated/hook.sh': '# shellcheck disable=SC1091\n', + [`.github/workflows/${workflowFile}`]: readWorkflow(workflowFile), + }); expect(result.status).toBe(0); expect(result.outputs.count).toBe('0'); diff --git a/.github/workflows/TESTS/run_terraform_checks.unit.test.js b/.github/workflows/TESTS/run_terraform_checks.unit.test.js index 9d5aeb9..fc0010d 100644 --- a/.github/workflows/TESTS/run_terraform_checks.unit.test.js +++ b/.github/workflows/TESTS/run_terraform_checks.unit.test.js @@ -18,12 +18,13 @@ describe('run_terraform_checks baselined count', () => { 'terraform/.checkov.baseline': baseline(['CKV_AWS_18', 'CKV_AWS_144']), 'terraform/modules/x/.checkov.baseline': baseline(['CKV_AWS_21']), 'terraform/main.tf': - 'resource "aws_s3_bucket" "a" {\n #checkov:skip=CKV_AWS_19: reason\n}\n# tflint-ignore: terraform_unused_declarations\n', + 'resource "aws_s3_bucket" "a" {\n #checkov:skip=CKV_AWS_19: reason\n # checkov:skip=CKV_AWS_20: reason\n}\n# tflint-ignore: terraform_unused_declarations\n// tflint-ignore-file: terraform_naming_convention\n', '.core-services/vendored.tf': '#checkov:skip=CKV_AWS_1: vendored\n', + 'README.md': '#checkov:skip=CKV_AWS_19: documented\n', }); expect(result.status).toBe(0); - expect(result.outputs.count).toBe('5'); + expect(result.outputs.count).toBe('7'); }); test("reports zero without a baseline or inline ignores, and doesn't count its own patterns", () => { diff --git a/.github/workflows/internal_on_push_ci.yml b/.github/workflows/internal_on_push_ci.yml index f21c8d1..1e8af40 100644 --- a/.github/workflows/internal_on_push_ci.yml +++ b/.github/workflows/internal_on_push_ci.yml @@ -47,13 +47,12 @@ jobs: with: node-version-file: .nvmrc - - name: Set up npm - run: npm install --global npm@12.2.1 # zizmor: ignore[adhoc-packages] AGENTS.md pins npm 12.1.0 and setup-node has no npm version input. - - name: Install dependencies id: install run: npm ci + # The audit runs here, not through run_npm_audit: this repository has only devDependencies, + # and run_npm_audit audits production dependencies only (--omit=dev), so it would check nothing. - name: Audit dependencies if: ${{ !cancelled() && steps.install.outcome == 'success' }} run: npm run audit:npm diff --git a/.github/workflows/run_gha_checks.yml b/.github/workflows/run_gha_checks.yml index e4a2e22..5fdb631 100644 --- a/.github/workflows/run_gha_checks.yml +++ b/.github/workflows/run_gha_checks.yml @@ -16,7 +16,7 @@ on: description: Outcome of the scan step (success, failure, cancelled or skipped) value: ${{ jobs.checks.outputs.scan }} baselined: - description: Number of inline zizmor ignore comments under .github + description: Number of inline zizmor ignore comments in YAML files under .github value: ${{ jobs.checks.outputs.baselined }} permissions: {} @@ -64,6 +64,6 @@ jobs: id: baseline if: ${{ !cancelled() }} run: | - inline=$({ git grep -c 'zizmor[:] *ignore' -- .github || true; } | awk -F: '{ sum += $NF } END { print sum + 0 }') + inline=$({ git grep -ohE '(^|[[:space:]])#[[:space:]]*zizmor:[[:space:]]*ignore\[' -- '.github/*.yml' '.github/*.yaml' || true; } | awk 'END { print NR }') echo "Inline zizmor ignores: $inline" echo "count=$inline" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/run_js_checks.yml b/.github/workflows/run_js_checks.yml index 01ba127..d373d47 100644 --- a/.github/workflows/run_js_checks.yml +++ b/.github/workflows/run_js_checks.yml @@ -20,7 +20,7 @@ on: description: Outcome of the format-check step (success, failure, cancelled or skipped) value: ${{ jobs.checks.outputs.format }} baselined: - description: Number of inline ESLint disable and Prettier ignore comments + description: Number of inline ESLint disable and Prettier ignore comments in JS and TS files value: ${{ jobs.checks.outputs.baselined }} permissions: {} @@ -75,6 +75,6 @@ jobs: id: baseline if: ${{ !cancelled() }} run: | - inline=$({ git grep -c -E 'eslint-disabl[e]|prettier-igno[r]e' -- ':!.core-services' || true; } | awk -F: '{ sum += $NF } END { print sum + 0 }') + inline=$({ git grep -ohE '(^|[[:space:]{])(//|/\*)[[:space:]]*(eslint-disable|prettier-ignore)' -- '*.js' '*.mjs' '*.cjs' '*.jsx' '*.ts' '*.mts' '*.cts' '*.tsx' ':!.core-services' || true; } | awk 'END { print NR }') echo "Inline ESLint and Prettier ignores: $inline" echo "count=$inline" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/run_markdown_checks.yml b/.github/workflows/run_markdown_checks.yml index 885082f..0a68be3 100644 --- a/.github/workflows/run_markdown_checks.yml +++ b/.github/workflows/run_markdown_checks.yml @@ -17,7 +17,7 @@ on: description: Outcome of the lint step (success, failure, cancelled or skipped) value: ${{ jobs.checks.outputs.lint }} baselined: - description: Number of inline markdownlint-disable comments in Markdown files + description: Number of inline markdownlint-disable directives in Markdown files value: ${{ jobs.checks.outputs.baselined }} permissions: {} @@ -66,6 +66,6 @@ jobs: id: baseline if: ${{ !cancelled() }} run: | - inline=$({ git grep -c 'markdownlint-disabl[e]' -- '*.md' ':!.core-services' || true; } | awk -F: '{ sum += $NF } END { print sum + 0 }') + inline=$({ git grep -ohE '(^|[[:space:]])