From 8461303b9e4d4f1a0c72acbc2f38cbf332c557ed Mon Sep 17 00:00:00 2001 From: Lucas Rodriguez Date: Mon, 6 May 2024 23:40:55 -0500 Subject: [PATCH] chore: add a check for go mod tidy Adds a shell script to check if go mod tidy needs to be ran in a PR. Adds a make target to call the script. Adds a workflow to run in CI. Adds this check as a pre-commit hook. --- .github/workflows/scan-go-mod-tidy.yml | 26 ++++++++++++++++++++++++++ .pre-commit-config.yaml | 4 ++++ Makefile | 4 ++++ hack/check-go-mod-tidy.sh | 9 +++++++++ 4 files changed, 43 insertions(+) create mode 100644 .github/workflows/scan-go-mod-tidy.yml create mode 100755 hack/check-go-mod-tidy.sh diff --git a/.github/workflows/scan-go-mod-tidy.yml b/.github/workflows/scan-go-mod-tidy.yml new file mode 100644 index 0000000000..2eab6ce696 --- /dev/null +++ b/.github/workflows/scan-go-mod-tidy.yml @@ -0,0 +1,26 @@ +name: Validate Go Mod Tidy +on: + pull_request: + paths: + - "go.mod" + - "go.sum" + +permissions: + contents: read + +jobs: + validate: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + + - name: Setup golang + uses: ./.github/actions/golang + + - name: Check go mod tidy + run: make test-go-mod-tidy + + - name: Save logs + if: always() + uses: ./.github/actions/save-logs diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 5e96cba653..38e3b129cf 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -47,6 +47,10 @@ repos: files: .go$ language: system pass_filenames: true + - id: check-go-mod-tidy + name: Check for out of sync Go module dependencies + entry: make test-go-mod-tidy + language: system - repo: https://github.com/python-jsonschema/check-jsonschema rev: 0.14.0 hooks: diff --git a/Makefile b/Makefile index 6adc76e641..18a61a82cd 100644 --- a/Makefile +++ b/Makefile @@ -220,6 +220,10 @@ test-docs-and-schema: test-cves: go run main.go tools sbom scan . -o json --exclude './site' --exclude './examples' | grype --fail-on low +# INTERNAL: used to test that a dev has ran `go mod tidy` in their PR +test-go-mod-tidy: + ./hack/check-go-mod-tidy.sh + cve-report: ## Create a CVE report for the current project (must `brew install grype` first) @test -d ./build || mkdir ./build go run main.go tools sbom scan . -o json --exclude './site' --exclude './examples' | grype -o template -t hack/grype.tmpl > build/zarf-known-cves.csv diff --git a/hack/check-go-mod-tidy.sh b/hack/check-go-mod-tidy.sh new file mode 100755 index 0000000000..d9603736e8 --- /dev/null +++ b/hack/check-go-mod-tidy.sh @@ -0,0 +1,9 @@ +#!/usr/bin/env bash + +set -euo pipefail + +go mod tidy +if ! git diff --quiet go.mod go.sum; then + echo "ERROR: Changes detected after running 'go mod tidy'. Please run 'go mod tidy' and commit the changes." + exit 1 +fi