Skip to content

Commit 81ec779

Browse files
yacosta738yacosta738
committed
fix: update Detekt workflow with fixes and v1.23.8 upgrade
- Quote YAML keys (on) and fix branch array spacing - Fix schedule cron indentation - Update DETEKT_RELEASE_TAG from v1.15.0 to v1.23.8 - Fix jq path for DETEKT_RELEASE_SHA extraction (tagCommit.oid) - Quote all shell variables in run scripts for safety - Quote github.workspace in jq --arg for relative URI step
1 parent c533dd8 commit 81ec779

1 file changed

Lines changed: 66 additions & 66 deletions

File tree

‎.github/workflows/detekt.yml‎

Lines changed: 66 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -17,22 +17,22 @@
1717
# environment variable.
1818
name: Scan with Detekt
1919

20-
on:
20+
"on":
2121
# Triggers the workflow on push or pull request events but only for default and protected branches
2222
push:
23-
branches: [ "main" ]
23+
branches: ["main"]
2424
pull_request:
25-
branches: [ "main" ]
25+
branches: ["main"]
2626
schedule:
27-
- cron: '38 13 * * 3'
27+
- cron: "38 13 * * 3"
2828

2929
# Allows you to run this workflow manually from the Actions tab
3030
workflow_dispatch:
3131

3232
env:
3333
# Release tag associated with version of Detekt to be installed
3434
# SARIF support (required for this workflow) was introduced in Detekt v1.15.0
35-
DETEKT_RELEASE_TAG: v1.15.0
35+
DETEKT_RELEASE_TAG: v1.23.8
3636

3737
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
3838
jobs:
@@ -44,75 +44,75 @@ jobs:
4444

4545
# Steps represent a sequence of tasks that will be executed as part of the job
4646
steps:
47-
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
48-
- uses: actions/checkout@v4
47+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
48+
- uses: actions/checkout@v4
4949

50-
# Gets the download URL associated with the $DETEKT_RELEASE_TAG
51-
- name: Get Detekt download URL
52-
id: detekt_info
53-
env:
54-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
55-
run: |
56-
gh api graphql --field tagName=$DETEKT_RELEASE_TAG --raw-field query='
57-
query getReleaseAssetDownloadUrl($tagName: String!) {
58-
repository(name: "detekt", owner: "detekt") {
59-
release(tagName: $tagName) {
60-
releaseAssets(name: "detekt", first: 1) {
61-
nodes {
62-
downloadUrl
50+
# Gets the download URL associated with the $DETEKT_RELEASE_TAG
51+
- name: Get Detekt download URL
52+
id: detekt_info
53+
env:
54+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
55+
run: |
56+
gh api graphql --field tagName=$DETEKT_RELEASE_TAG --raw-field query='
57+
query getReleaseAssetDownloadUrl($tagName: String!) {
58+
repository(name: "detekt", owner: "detekt") {
59+
release(tagName: $tagName) {
60+
releaseAssets(name: "detekt", first: 1) {
61+
nodes {
62+
downloadUrl
63+
}
64+
}
65+
tagCommit {
66+
oid
6367
}
64-
}
65-
tagCommit {
66-
oid
6768
}
6869
}
6970
}
70-
}
71-
' 1> gh_response.json
71+
' 1> gh_response.json
7272
73-
DETEKT_RELEASE_SHA=$(jq --raw-output '.data.repository.release.releaseAssets.tagCommit.oid' gh_response.json)
74-
if [ $DETEKT_RELEASE_SHA != "37f0a1d006977512f1f216506cd695039607c3e5" ]; then
75-
echo "Release tag doesn't match expected commit SHA"
76-
exit 1
77-
fi
73+
DETEKT_RELEASE_SHA=$(jq --raw-output '.data.repository.release.tagCommit.oid' gh_response.json)
74+
if [ "$DETEKT_RELEASE_SHA" != "37f0a1d006977512f1f216506cd695039607c3e5" ]; then
75+
echo "Release tag doesn't match expected commit SHA"
76+
exit 1
77+
fi
7878
79-
DETEKT_DOWNLOAD_URL=$(jq --raw-output '.data.repository.release.releaseAssets.nodes[0].downloadUrl' gh_response.json)
80-
echo "download_url=$DETEKT_DOWNLOAD_URL" >> $GITHUB_OUTPUT
79+
DETEKT_DOWNLOAD_URL=$(jq --raw-output '.data.repository.release.releaseAssets.nodes[0].downloadUrl' gh_response.json)
80+
echo "download_url=$DETEKT_DOWNLOAD_URL" >> "$GITHUB_OUTPUT"
8181
82-
# Sets up the detekt cli
83-
- name: Setup Detekt
84-
run: |
85-
dest=$( mktemp -d )
86-
curl --request GET \
87-
--url ${{ steps.detekt_info.outputs.download_url }} \
88-
--silent \
89-
--location \
90-
--output $dest/detekt
91-
chmod a+x $dest/detekt
92-
echo $dest >> $GITHUB_PATH
82+
# Sets up the detekt cli
83+
- name: Setup Detekt
84+
run: |
85+
dest="$(mktemp -d)"
86+
curl --request GET \
87+
--url "${{ steps.detekt_info.outputs.download_url }}" \
88+
--silent \
89+
--location \
90+
--output "$dest/detekt"
91+
chmod a+x "$dest/detekt"
92+
echo "$dest" >> "$GITHUB_PATH"
9393
94-
# Performs static analysis using Detekt
95-
- name: Run Detekt
96-
continue-on-error: true
97-
run: |
98-
detekt --input ${{ github.workspace }} --report sarif:${{ github.workspace }}/detekt.sarif.json
94+
# Performs static analysis using Detekt
95+
- name: Run Detekt
96+
continue-on-error: true
97+
run: |
98+
detekt --input "${{ github.workspace }}" --report sarif:"${{ github.workspace }}/detekt.sarif.json"
9999
100-
# Modifies the SARIF output produced by Detekt so that absolute URIs are relative
101-
# This is so we can easily map results onto their source files
102-
# This can be removed once relative URI support lands in Detekt: https://git.io/JLBbA
103-
- name: Make artifact location URIs relative
104-
continue-on-error: true
105-
run: |
106-
echo "$(
107-
jq \
108-
--arg github_workspace ${{ github.workspace }} \
109-
'. | ( .runs[].results[].locations[].physicalLocation.artifactLocation.uri |= if test($github_workspace) then .[($github_workspace | length | . + 1):] else . end )' \
110-
${{ github.workspace }}/detekt.sarif.json
111-
)" > ${{ github.workspace }}/detekt.sarif.json
100+
# Modifies the SARIF output produced by Detekt so that absolute URIs are relative
101+
# This is so we can easily map results onto their source files
102+
# This can be removed once relative URI support lands in Detekt: https://git.io/JLBbA
103+
- name: Make artifact location URIs relative
104+
continue-on-error: true
105+
run: |
106+
echo "$(
107+
jq \
108+
--arg github_workspace "${{ github.workspace }}" \
109+
'. | ( .runs[].results[].locations[].physicalLocation.artifactLocation.uri |= if test($github_workspace) then .[($github_workspace | length | . + 1):] else . end )' \
110+
"${{ github.workspace }}/detekt.sarif.json"
111+
)" > "${{ github.workspace }}/detekt.sarif.json"
112112
113-
# Uploads results to GitHub repository using the upload-sarif action
114-
- uses: github/codeql-action/upload-sarif@v3
115-
with:
116-
# Path to SARIF file relative to the root of the repository
117-
sarif_file: ${{ github.workspace }}/detekt.sarif.json
118-
checkout_path: ${{ github.workspace }}
113+
# Uploads results to GitHub repository using the upload-sarif action
114+
- uses: github/codeql-action/upload-sarif@v3
115+
with:
116+
# Path to SARIF file relative to the root of the repository
117+
sarif_file: ${{ github.workspace }}/detekt.sarif.json
118+
checkout_path: ${{ github.workspace }}

0 commit comments

Comments
 (0)