trivy/.github/workflows/semantic-pr.yaml at c6cb3e1ed4ab948224e7b2080181f756cb2820fb · aquasecurity/trivy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
name: "Validate PR Title"

on:
  pull_request:
    types:
      - opened
      - edited
      - synchronize

jobs:
  validate:
    name: Validate PR title
    runs-on: ubuntu-latest
    steps:
      - name: Validate PR title
        shell: bash
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
          # Valid types
          VALID_TYPES: |
            feat
            fix
            docs
            style
            refactor
            perf
            test
            build
            ci
            chore
            revert
            release
          # Valid scopes categorized by area
          VALID_SCOPES: |
            # Scanners
            vuln
            misconf
            secret
            license

            # Targets
            image
            fs
            repo
            sbom
            server
            k8s
            aws
            vm
            plugin

            # OS
            activestate
            alpine
            bottlerocket
            wolfi
            chainguard
            redhat
            alma
            rocky
            mariner
            oracle
            debian
            ubuntu
            amazon
            suse
            photon
            echo
            distroless
            windows
            minimos
            rootio
            seal

            # Languages
            ruby
            php
            python
            nodejs
            rust
            dotnet
            java
            go
            c
            c++
            elixir
            dart
            swift
            bitnami
            conda
            julia

            # Package types
            os
            lang

            # IaC
            kubernetes
            dockerfile
            terraform
            cloudformation

            # Container
            docker
            podman
            containerd
            oci

            # SBOM
            sbom
            spdx
            cyclonedx

            # Misc
            cli
            flag
            purl
            vex
            helm
            report
            db
            parser
            deps
        run: |
          set -euo pipefail

          # Convert env vars to regex alternatives, excluding comments and empty lines
          TYPES_REGEX=$(echo "$VALID_TYPES" | grep -v '^$' | paste -sd '|')
          SCOPES_REGEX=$(echo "$VALID_SCOPES" | grep -v '^$' | grep -v '^#' | paste -sd '|')

          # Basic format check (should match: type(scope): description or type: description)
          FORMAT_REGEX="^[a-z]+(\([a-z0-9+]+\))?!?: .+$"
          if ! echo "$PR_TITLE" | grep -qE "$FORMAT_REGEX"; then
            echo "Error: Invalid PR title format"
            echo "Expected format: <type>(<scope>): <description> or <type>: <description>"
            echo "Examples:"
            echo "  feat(vuln): add new vulnerability detection"
            echo "  fix: correct parsing logic"
            echo "  docs(kubernetes): update installation guide"
            echo -e "\nCurrent title: $PR_TITLE"
            exit 1
          fi

          # Extract type and scope for validation
          TYPE=$(echo "$PR_TITLE" | sed -E 's/^([a-z]+)(\([a-z0-9+]+\))?!?: .+$/\1/')
          SCOPE=$(echo "$PR_TITLE" | sed -E 's/^[a-z]+\(([a-z0-9+]+)\)!?: .+$/\1/; t; s/.*//')

          # Validate type
          if ! echo "$VALID_TYPES" | grep -qx "$TYPE"; then
            echo "Error: Invalid type '${TYPE}'"
            echo -e "\nValid types:"
            echo "$VALID_TYPES" | grep -v '^$' | sed 's/^/- /'
            echo -e "\nCurrent title: $PR_TITLE"
            exit 1
          fi

          # Validate scope if present
          if [ -n "$SCOPE" ]; then
            if ! echo "$VALID_SCOPES" | grep -v '^#' | grep -qx "$SCOPE"; then
              echo "Error: Invalid scope '${SCOPE}'"
              echo -e "\nValid scopes:"
              echo "$VALID_SCOPES" | grep -v '^$' | grep -v '^#' | sed 's/^/- /'
              echo -e "\nCurrent title: $PR_TITLE"
              exit 1
            fi
          fi

          echo "PR title validation passed ✅"
          echo "Current title: $PR_TITLE"