Repository navigation
feat(android): let callers choose the JDK of the APK release job #439
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint Workflows | |
| env: | |
| GIST_CACHE_ID: "d7ae5d4397f1fd4c7ca82fa53912c8cc" | |
| on: | |
| workflow_call: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - ".github/workflows/**" | |
| - ".github/actionlint.yaml" | |
| jobs: | |
| actionlint: | |
| name: Validate GitHub Actions workflows | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Detect repository context | |
| id: context | |
| run: | | |
| REPO="${{ github.repository }}" | |
| if [ "$REPO" = "tehw0lf/workflows" ]; then | |
| echo "is_workflow_repo=true" >> $GITHUB_OUTPUT | |
| echo "::notice::Running in workflows repository - write mode enabled" | |
| echo "workflows_ref=${{ github.sha }}" >> $GITHUB_OUTPUT | |
| else | |
| echo "is_workflow_repo=false" >> $GITHUB_OUTPUT | |
| echo "::notice::Running in external repository - read-only mode" | |
| echo "workflows_ref=main" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Checkout workflow repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| repository: tehw0lf/workflows | |
| ref: ${{ steps.context.outputs.workflows_ref }} | |
| path: workflows-repo | |
| persist-credentials: false | |
| - name: Generate workflow hash for cache key | |
| id: workflow-hash | |
| run: | | |
| cd workflows-repo/.github | |
| HASH=$( (find workflows -type f \( -name '*.yml' -o -name '*.yaml' \); find . -maxdepth 1 -name 'actionlint.yaml') | sort | xargs sha256sum | sha256sum | cut -d' ' -f1) | |
| echo "hash=$HASH" >> $GITHUB_OUTPUT | |
| echo "::notice::[Lint] Workflow hash: $HASH" | |
| - name: Check Gist cache for validated hash | |
| id: gist-cache | |
| run: | | |
| GIST_ID="${{ env.GIST_CACHE_ID }}" | |
| HASH="${{ steps.workflow-hash.outputs.hash }}" | |
| if [ -z "$GIST_ID" ]; then | |
| echo "::notice::[Lint] No Gist cache configured" | |
| echo "cache-hit=false" >> $GITHUB_OUTPUT | |
| exit 0 | |
| fi | |
| # Fetch Gist content via public raw URL (no authentication needed for public gists) | |
| GIST_CONTENT=$(curl -fsSL "https://gist.githubusercontent.com/tehw0lf/$GIST_ID/raw" 2>&1 || echo "") | |
| if echo "$GIST_CONTENT" | grep -qF "$HASH"; then | |
| echo "::notice::[Lint] ✅ Validation cache hit (cross-repository Gist cache)" | |
| echo "cache-hit=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "::notice::[Lint] Hash not found in Gist cache - will validate workflows" | |
| echo "cache-hit=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Install actionlint | |
| if: steps.gist-cache.outputs.cache-hit != 'true' | |
| run: | | |
| bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) | |
| sudo mv actionlint /usr/local/bin/ | |
| - name: Run actionlint | |
| if: steps.gist-cache.outputs.cache-hit != 'true' | |
| run: | | |
| cd workflows-repo | |
| actionlint -color -config-file .github/actionlint.yaml .github/workflows/*.yml | |
| - name: Update Gist cache with validated hash | |
| if: | | |
| steps.gist-cache.outputs.cache-hit != 'true' && | |
| steps.context.outputs.is_workflow_repo == 'true' | |
| env: | |
| GIST_ID: ${{ env.GIST_CACHE_ID }} | |
| GH_TOKEN: ${{ secrets.WORKFLOW_VALIDATION_TOKEN }} | |
| run: | | |
| HASH="${{ steps.workflow-hash.outputs.hash }}" | |
| if [ -z "$GIST_ID" ]; then | |
| echo "::notice::[Lint] No Gist cache configured" | |
| exit 0 | |
| fi | |
| if [ -z "$GH_TOKEN" ]; then | |
| echo "::notice::[Lint] Skipping Gist update (WORKFLOW_VALIDATION_TOKEN secret not set)" | |
| exit 0 | |
| fi | |
| # Update Gist with latest validated hash | |
| echo "$HASH" > validated-hashes.txt | |
| gh gist edit "$GIST_ID" validated-hashes.txt | |
| echo "::notice::[Lint] Updated Gist cache for cross-repository sharing" | |
| - name: Workflow validation summary | |
| run: | | |
| if [ "${{ steps.gist-cache.outputs.cache-hit }}" = "true" ]; then | |
| echo "✅ Workflow validation passed (cross-repository Gist cache)" | |
| echo "::notice::[Lint] Validation result retrieved from Gist cache" | |
| else | |
| echo "✅ All workflows passed actionlint validation" | |
| echo "::notice::[Lint] Validation completed and cached in Gist for future runs" | |
| fi |