chore(deps): update dependency oliwebd/o-tiling to v2.9.17 #425
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint | |
| # Fast static gate (~1 min) in front of the 25-minute image build. | |
| # Born from the 2026-06-12 code-quality review: that week's two real | |
| # bugs lived in a just-recipe body and a workflow expression — places | |
| # no existing check was looking at. actionlint covers workflow files | |
| # (including shellcheck over run: blocks); the shellcheck step covers | |
| # build scripts AND the extensionless bash shipped into the image under | |
| # build_files/system_files (which an extension-glob lint never saw). | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: lint-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 8 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: actionlint (workflows, incl. shellcheck on run blocks) | |
| uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 | |
| env: | |
| # Gate on warnings and above. The info/style tail (quote | |
| # $GITHUB_OUTPUT, SC2129 grouped redirects) is tracked for the | |
| # phase-3 inline-bash extraction, not worth failing builds on. | |
| SHELLCHECK_OPTS: --severity=warning | |
| with: | |
| args: -color | |
| - name: hadolint (Containerfile) | |
| # Lints the active bootc ./Containerfile (Containerfile.plan-b-from- | |
| # bluefin is a dormant fallback, intentionally not linted). Rules and | |
| # the warning-level failure threshold live in .hadolint.yaml so a | |
| # local `hadolint Containerfile` matches CI. SHA-pinned like every | |
| # other action here. | |
| uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 | |
| with: | |
| dockerfile: Containerfile | |
| config: .hadolint.yaml | |
| - name: Flatpak-bake + console fix invariants (regression guard) | |
| # Static guard for the 2026-06 fresh-install Flatpak-bake fixes and | |
| # the phantom-UART console fix (forum 12247) — install-time-only | |
| # behaviours no boot-test exercises. Fails if any is silently undone. | |
| run: .github/scripts/check-flatpak-fixes.sh | |
| - name: shellcheck (tracked *.sh + shebang-discovered system_files) | |
| # -S warning: the only info-level items are SC1091 ("can't | |
| # follow /ctx/00-common.sh") — a build-container path that does | |
| # not exist at lint time, structurally unfixable here. | |
| run: | | |
| set -euo pipefail | |
| mapfile -t SH < <(git ls-files '*.sh' | grep -v '^live-env/references/') | |
| mapfile -t BIN < <(git grep -lE '^#!.*\b(ba)?sh\b' -- build_files/system_files | grep -v '\.sh$' || true) | |
| printf 'shellcheck over %d scripts\n' "$(( ${#SH[@]} + ${#BIN[@]} ))" | |
| shellcheck -S warning "${SH[@]}" "${BIN[@]}" | |
| - name: ruff (python build helpers) | |
| run: | | |
| set -euo pipefail | |
| mapfile -t PY < <(git ls-files '*.py') | |
| pipx run ruff check "${PY[@]}" | |
| - name: BAKE flatpak lists must not drift | |
| # installer/flatpaks-base (OCI image manifest) and | |
| # live-env/src/flatpaks (live ISO bake) are content-identical by | |
| # contract but only by discipline — this asserts it (review P3.4). | |
| run: | | |
| set -euo pipefail | |
| norm() { grep -vE '^[[:space:]]*#|^[[:space:]]*$' "$1" | sed -E 's/[[:space:]]*#.*$//; s/^[[:space:]]+//; s/[[:space:]]+$//' | grep -v '^$' | sort; } | |
| if ! diff <(norm installer/flatpaks-base) <(norm live-env/src/flatpaks); then | |
| echo "::error::installer/flatpaks-base and live-env/src/flatpaks have drifted — edit both together" | |
| exit 1 | |
| fi | |
| echo "BAKE lists in sync" | |
| - name: just syntax (60-custom.just + Justfile parse) | |
| # rust-just on PyPI ships the `just` binary; pipx is | |
| # preinstalled on GitHub runners — no apt dependency. | |
| run: | | |
| set -euo pipefail | |
| pipx run --spec rust-just just --summary --justfile build_files/60-custom.just >/dev/null | |
| echo "60-custom.just OK" | |
| pipx run --spec rust-just just --summary >/dev/null | |
| echo "Justfile OK" |