tanshu
2aab1aec1e
gitleaks runs before each commit and in CI, with known values in a redacted baseline. The layout check rejects empty readmes and main.yml role entrypoints. --changed lints only the YAML files that differ from HEAD.
136 lines
3.7 KiB
Bash
Executable File
136 lines
3.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Run every check this repo has. CI and pre-commit call the same script.
|
|
# Usage: scripts/check.sh [--changed]
|
|
set -euo pipefail
|
|
shopt -s nullglob
|
|
|
|
cd "$(dirname "${BASH_SOURCE[0]}")/.."
|
|
|
|
changed=0
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--changed) changed=1 ;;
|
|
*)
|
|
echo "unknown argument: $arg" >&2
|
|
echo "usage: scripts/check.sh [--changed]" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
done
|
|
|
|
# Ansible and uv want writable caches. Keep them in the checkout so the script
|
|
# works when $HOME is read-only, which is the case in the agent sandbox.
|
|
export ANSIBLE_CONFIG="${ANSIBLE_CONFIG:-$PWD/ansible.cfg}"
|
|
export ANSIBLE_HOME="${ANSIBLE_HOME:-$PWD/.ansible/home}"
|
|
export ANSIBLE_LOCAL_TEMP="${ANSIBLE_LOCAL_TEMP:-$PWD/.ansible/tmp}"
|
|
export ANSIBLE_GALAXY_CACHE_DIR="${ANSIBLE_GALAXY_CACHE_DIR:-$PWD/.ansible/galaxy_cache}"
|
|
export UV_CACHE_DIR="${UV_CACHE_DIR:-$PWD/.ansible/uv-cache}"
|
|
export UV_TOOL_DIR="${UV_TOOL_DIR:-$PWD/.ansible/uv-tools}"
|
|
export XDG_CACHE_HOME="${XDG_CACHE_HOME:-$PWD/.scratch/cache}"
|
|
export PIP_CACHE_DIR="${PIP_CACHE_DIR:-$PWD/.scratch/cache/pip}"
|
|
mkdir -p "$ANSIBLE_LOCAL_TEMP" "$UV_CACHE_DIR" "$UV_TOOL_DIR" \
|
|
"$ANSIBLE_GALAXY_CACHE_DIR" "$ANSIBLE_HOME" "$XDG_CACHE_HOME" "$PIP_CACHE_DIR"
|
|
|
|
if [ -f requirements.yml ]; then
|
|
echo "== ansible-galaxy collection install =="
|
|
ansible-galaxy collection install -r requirements.yml
|
|
fi
|
|
|
|
run() {
|
|
local tool="$1"
|
|
shift
|
|
if command -v "$tool" >/dev/null 2>&1; then
|
|
"$tool" "$@"
|
|
else
|
|
uvx "$tool" "$@"
|
|
fi
|
|
}
|
|
|
|
# YAML files that differ from HEAD, including new files that are not staged yet.
|
|
yaml_files=()
|
|
if [ "$changed" = 1 ]; then
|
|
while IFS= read -r file; do
|
|
[ -n "$file" ] && yaml_files+=("$file")
|
|
done < <(
|
|
git diff --name-only --diff-filter=ACMR HEAD -- '*.yml' '*.yaml'
|
|
git ls-files --others --exclude-standard -- '*.yml' '*.yaml'
|
|
)
|
|
fi
|
|
|
|
# ansible-lint only understands Ansible files, so keep the changed files that
|
|
# live under a service with a playbook.
|
|
ansible_files=()
|
|
if [ "$changed" = 1 ]; then
|
|
for file in "${yaml_files[@]}"; do
|
|
service="${file%%/*}"
|
|
if [ -f "$service/playbook.yml" ]; then
|
|
ansible_files+=("$file")
|
|
fi
|
|
done
|
|
fi
|
|
|
|
if [ "$changed" = 1 ] && [ "${#yaml_files[@]}" -eq 0 ]; then
|
|
echo "== changed mode: no YAML files changed =="
|
|
else
|
|
echo "== yamllint =="
|
|
if [ "$changed" = 1 ]; then
|
|
run yamllint "${yaml_files[@]}"
|
|
else
|
|
run yamllint .
|
|
fi
|
|
|
|
echo "== ansible-lint =="
|
|
if [ "$changed" = 1 ] && [ "${#ansible_files[@]}" -eq 0 ]; then
|
|
echo "no changed Ansible files"
|
|
elif [ "$changed" = 1 ]; then
|
|
run ansible-lint "${ansible_files[@]}"
|
|
else
|
|
run ansible-lint
|
|
fi
|
|
fi
|
|
|
|
echo "== layout =="
|
|
layout_ok=1
|
|
for playbook in */playbook.yml; do
|
|
service="${playbook%/playbook.yml}"
|
|
if [ ! -s "$service/readme.md" ]; then
|
|
echo "missing or empty $service/readme.md" >&2
|
|
layout_ok=0
|
|
fi
|
|
done
|
|
for entrypoint in */roles/*/tasks/main.yml */roles/*/handlers/main.yml; do
|
|
echo "role entrypoint must use .yaml: $entrypoint" >&2
|
|
layout_ok=0
|
|
done
|
|
if [ "$layout_ok" -ne 1 ]; then
|
|
exit 1
|
|
fi
|
|
|
|
echo "== gitleaks =="
|
|
./scripts/check-secrets.sh
|
|
|
|
echo "== ansible-playbook --syntax-check =="
|
|
playbooks=()
|
|
if [ "$changed" = 1 ]; then
|
|
for file in "${yaml_files[@]}"; do
|
|
service="${file%%/*}"
|
|
if [ -f "$service/playbook.yml" ]; then
|
|
playbooks+=("$service/playbook.yml")
|
|
fi
|
|
done
|
|
if [ "${#playbooks[@]}" -gt 0 ]; then
|
|
mapfile -t playbooks < <(printf '%s\n' "${playbooks[@]}" | sort -u)
|
|
fi
|
|
else
|
|
playbooks=(*/playbook.yml)
|
|
fi
|
|
|
|
if [ "${#playbooks[@]}" -eq 0 ]; then
|
|
echo "no playbooks to check"
|
|
else
|
|
for playbook in "${playbooks[@]}"; do
|
|
echo "-- $playbook"
|
|
ansible-playbook --syntax-check "$playbook"
|
|
done
|
|
fi
|