donotsubmit.yml

name: Do Not Submit

on:
  pull_request:
    branches: [ 'main' ]

permissions: read-all

jobs:

  donotsubmit:
    name: Do Not Submit
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 #v2.4.0
        with:
          ssh-key: ${{ secrets.BLOG_SECRET_KEY }}
            
      - name: Do Not Submit
        shell: bash
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ github.token }}
        run: |
          set -e
          cd "${GITHUB_WORKSPACE}" || exit 1
          TEMP_PATH="$(mktemp -d)"
          PATH="${TEMP_PATH}:$PATH"
          echo '::group::🐶 Installing reviewdog v0.13.1 ... https://github.com/reviewdog/reviewdog'
          reviewdog_sha='08a5a323939101195af1d420ab6be3a50ec12f58e3419e3fcd07b6871f0b9a7e'
          curl -s -L https://github.com/reviewdog/reviewdog/releases/download/v0.13.1/reviewdog_0.13.1_Linux_x86_64.tar.gz --output "${TEMP_PATH}/reviewdog.tar.gz"
          echo '::group::🐶 Verifying checksum of download'
          computed_sha=`sha256sum ${TEMP_PATH}/reviewdog.tar.gz|cut -d ' ' -f 1`
          if [[ $reviewdog_sha != $computed_sha ]]; then
            echo '::group::🐶 Failed to verify checksum, exiting!'
            exit 1
          fi
          echo '::group::🐶 Checksum verified successfully, extracting reviewdog'
          tar zxf "${TEMP_PATH}/reviewdog.tar.gz" -C ${TEMP_PATH} reviewdog
          echo '::endgroup::'
          echo '::group:: Running DO NOT SUBMIT with reviewdog 🐶 ...'
          # Don't fail because of grep
          set +o pipefail
          find . -type f -not -path './vendor/*' -not -path './third_party/*' -not -path './.git/*' -not -path './.github/workflows/*' |
          xargs grep -n "DO NOT SUBMIT" |
          reviewdog -efm="%f:%l:%m" \
                -name="DO NOT SUBMIT" \
                -reporter="github-pr-check" \
                -filter-mode="added" \
                -fail-on-error="true" \
                -level="error"
          echo '::endgroup::'