shellcheck.yml

---
name: Shellcheck

on:
  # /!\ Warning: using the pull_request_target event to be able to read secrets. But using this event without the cautionary measures described below
  # may allow unauthorized GitHub users to open a "pwn request" and exfiltrate secrets.
  # As recommended in https://iterative.ai/blog/testing-external-contributions-using-github-actions-secrets,
  # we are adding an 'authorize' job that checks if the workflow was triggered from a fork PR. In that case, the "external" environment
  # will prevent the job from running until it's approved manually by human intervention.
  pull_request_target:
    types: [opened, synchronize, reopened, ready_for_review]
    paths:
      - '**.sh'
    branches:
      - main
      - 'release-[0-9]+.[0-9]+'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.event.pull_request.head.sha }}
  cancel-in-progress: true

env:
  GH_TEAM: rhdh
  GH_ORGANIZATION: redhat-developer

jobs:
  check-commit-author:
    runs-on: ubuntu-latest
    outputs:
      is_authorized: ${{ steps.check-team-membership.outputs.is_active_member }}
    steps:
      - name: Generate GitHub App Token
        id: app-token
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
        with:
          app-id: ${{ secrets.RHDH_GITHUB_APP_ID }}
          private-key: ${{ secrets.RHDH_GITHUB_APP_PRIVATE_KEY }}
      - name: Check team membership
        uses: redhat-developer/rhdh/.github/actions/check-author@main
        id: check-team-membership
        with:
          team: ${{ env.GH_TEAM }}
          organization: ${{ env.GH_ORGANIZATION }}
          gh_token: ${{ steps.app-token.outputs.token }}
          author: ${{ github.event.pull_request.user.login }}
          whitelisted_authors: '["openshift-cherrypick-robot"]'

  authorize:
    # The 'external' environment is configured with the rhdh-content team as required reviewers.
    # All the subsequent jobs in this workflow 'need' this job, which will require manual approval for PRs coming from external forks outside of the rhdh team
    needs: check-commit-author
    environment:
      ${{ (needs.check-commit-author.outputs.is_authorized == 'true' || github.event.pull_request.head.repo.full_name == github.repository) && 'internal' || 'external' }}
    runs-on: ubuntu-latest
    steps:
      - name: Check if internal PR
        id: check
        run: |
          if [[ "${{ needs.check-commit-author.outputs.is_authorized }}" == "true" ]]; then
            echo "✓ Commit author is in rhdh team - using internal environment"
          elif [[ "${{ github.event.pull_request.head.repo.full_name }}" == "${{ github.repository }}" ]]; then
            echo "✓ Internal PR (not from fork) - using internal environment"
          else
            echo "✓ External PR from fork from non-rhdh team member - using external environment for security"
          fi

  shellcheck:
    name: Shellcheck Analysis
    runs-on: ubuntu-latest
    needs: authorize
    permissions:
      contents: read
      pull-requests: write
      checks: write
    steps:
      - name: Checkout PR branch for scripts to check
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Setup reviewdog
        uses: reviewdog/action-setup@19ad6fc8b7358ccdc9fd4a25c75dd93eeb097e1e # v1
        with:
          reviewdog_version: latest

      - name: Get changed shell scripts
        id: changed-files
        run: |
          # Get list of changed .sh files that still exist (exclude deletions).
          # Fetch the base ref from the upstream repository rather than "origin":
          # for fork PRs (for example, openshift-cherrypick-robot cherry-picks) the
          # checked-out repo is the fork, which does not contain the base branch,
          # so "git fetch origin ${{ github.base_ref }}" fails.
          git fetch https://github.com/${{ github.repository }}.git ${{ github.base_ref }}
          ALL_CHANGED=$(git diff --name-only FETCH_HEAD...HEAD | grep '\.sh$' || echo "")
          CHANGED_FILES=""
          while IFS= read -r file; do
            if [ -n "$file" ] && [ -f "$file" ]; then
              CHANGED_FILES="${CHANGED_FILES:+$CHANGED_FILES
          }$file"
            fi
          done <<< "$ALL_CHANGED"
          echo "changed_files<<EOF" >> $GITHUB_OUTPUT
          echo "$CHANGED_FILES" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

          # Count changed files
          if [ -n "$CHANGED_FILES" ]; then
            COUNT=$(echo "$CHANGED_FILES" | wc -l)
          else
            COUNT=0
          fi
          echo "count=$COUNT" >> $GITHUB_OUTPUT

      - name: Run shellcheck on changed scripts
        if: steps.changed-files.outputs.count > 0
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.RHDH_BOT_TOKEN }}
          CHANGED_FILES: ${{ steps.changed-files.outputs.changed_files }}
        run: |
          # Run shellcheck on each changed script and pipe to reviewdog
          while IFS= read -r file; do
            if [ -n "$file" ] && [ -f "$file" ]; then
              shellcheck -f checkstyle "$file" || true
            fi
          done <<< "$CHANGED_FILES" | \
          reviewdog -f=checkstyle \
            -name="shellcheck" \
            -reporter=github-pr-review \
            -filter-mode=nofilter \
            -fail-on-error=false \
            -level=warning

      - name: Post shellcheck summary as PR comment
        if: always()
        uses: actions/github-script@v7
        env:
          CHANGED_FILES: ${{ steps.changed-files.outputs.changed_files }}
          CHANGED_FILES_COUNT: ${{ steps.changed-files.outputs.count }}
        with:
          github-token: ${{ secrets.RHDH_BOT_TOKEN || secrets.GITHUB_TOKEN }}
          script: |
            const changedFilesCount = parseInt(process.env.CHANGED_FILES_COUNT, 10);
            const changedFiles = (process.env.CHANGED_FILES || '').split('\n').filter(f => f);

            let comment = '## Shellcheck Analysis Results\n\n';

            if (changedFilesCount > 0) {
              comment += `**Changed shell scripts in this PR:** ${changedFilesCount}\n\n`;
              comment += '### Scripts analyzed:\n';
              changedFiles.forEach(file => {
                comment += `- \`${file}\`\n`;
              });
              comment += '\n';
              comment += 'Check the **Files changed** tab for detailed shellcheck suggestions.\n\n';
              comment += 'All findings are reported as warnings and won\'t block the PR.\n\n';
            } else {
              comment += 'No shell scripts were changed in this PR.\n\n';
            }

            comment += '---\n';
            comment += '*Automated shellcheck analysis • See [shellcheck.net](https://www.shellcheck.net/) for details*\n';

            // Find existing shellcheck comment
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });

            const botComment = comments.find(c =>
              c.body.includes('Shellcheck Analysis Results')
            );

            if (botComment) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: botComment.id,
                body: comment
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body: comment
              });
            }