qa-compliance.yml

# Copyright (c) 2021-2024 TiaC Systems
# SPDX-License-Identifier: Apache-2.0

name: QA Compliance Check

on:
  workflow_dispatch: # And manually on button click
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  qa-compliance:
    name: Run compliance checks on patch series (PR)
    runs-on: ubuntu-latest

    steps:
      - name: Apply container HTTP/2 framing layer workaround
        run: |
          # FIXME: For unknown reasons, the local development host and CI is
          #        running in temporary "Error in the HTTP2 framing layer".
          #        Forcing the historical but still supported HTTP/1.1 layer
          #        seems to be a stable workaround - happened in Oct. 2023.
          git config --global --add http.version HTTP/1.1

      - name: Update GitHub PATH for west
        run: |
          echo "$HOME/.local/bin" >> $GITHUB_PATH

      - name: Checkout the code
        uses: actions/checkout@v4
        with:
          path: workspace/bridle
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Restore PIP Cache
        uses: actions/cache@v4
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-doc-pip

      - name: Install base dependencies
        working-directory: workspace
        run: |
          pip3 install --upgrade pip
          pip3 install --upgrade setuptools
          pip3 install --upgrade --requirement bridle/scripts/requirements-base.txt
          pip3 show -f west

      - name: West init and update
        working-directory: workspace
        env:
          BASE_REF: ${{ github.base_ref }}
        run: |
          git -C bridle config --global user.email "you@example.com"
          git -C bridle config --global user.name "Your Name"
          git -C bridle remote -v
          # Ensure there's no merge commits in the PR
          [[ "$(git -C bridle rev-list --merges --count origin/${BASE_REF}..)" == "0" ]] || \
          (echo "::error ::Merge commits not allowed, rebase instead";false)
          git -C bridle rebase origin/${BASE_REF}
          # debug
          git -C bridle log  --pretty=oneline | head -n 10
          west init --local bridle || true
          west update --fetch=always --stats
          west zephyr-export
          west bridle-export

      - name: Install compliance dependencies
        working-directory: workspace
        run: |
          grep -hE -v "python-magic-bin" zephyr/scripts/requirements-*.txt | \
          grep -hE "python-magic|lxml|junitparser|gitlint|pylint|pykwalify|unidiff|yamllint" | \
          xargs -I {} pip3 install --upgrade '{}'

      - name: Run compliance tests
        id: compliance
        working-directory: workspace/bridle
        env:
          BASE_REF: ${{ github.base_ref }}
        run: |
          export BRIDLE_BASE="$(pwd)"
          export ZEPHYR_BASE="$(dirname "$(pwd)")/zephyr"
          # debug
          ls -la
          git log --pretty=oneline | head -n 10
          # -m Kconfig \
          ${BRIDLE_BASE}/scripts/ci/check_compliance.py \
            --annotate \
            -m BinaryFiles \
            -m BoardYml \
            -m Checkpatch \
            -m DevicetreeBindings \
            -m GitDiffCheck \
            -m Gitlint \
            -m Identity \
            -m ImageSize \
            -m KconfigBasic \
            -m KconfigBasicNoModules \
            -m KconfigHWMv2 \
            -m KeepSorted \
            -m MaintainersFormat \
            -m ModulesMaintainers \
            -m Nits \
            -m Pylint \
            -m YAMLLint \
            -c origin/${BASE_REF}..

      - name: Upload compliance tests results
        uses: actions/upload-artifact@v4
        with:
          name: compliance.xml
          path: workspace/bridle/compliance.xml

      - name: Convert compliance test reports to annotations
        uses: mikepenz/action-junit-report@v4
        with:
          check_name: compliance-report (bridle)
          report_paths: "**/bridle/compliance.xml"
          require_tests: true
          fail_on_failure: false
        if: always()

      - name: Check warnings
        working-directory: workspace/bridle
        run: |
          if [[ ! -s "compliance.xml" ]]; then
            exit 1;
          fi

          #       Checkpatch.txt \
          #       Kconfig.txt \
          for file in \
                  Nits.txt \
                  Identity.txt \
                  GitDiffCheck.txt \
                  Gitlint.txt \
                  Pylint.txt \
                  YAMLLint.txt \
                  MaintainersFormat.txt \
                  ModulesMaintainers.txt \
                  DevicetreeBindings.txt \
                  KconfigBasicNoModules.txt \
                  KconfigBasic.txt \
                  KeepSorted.txt \
                  ImageSize.txt \
                  BinaryFiles.txt \
              ; do
            if [[ -s $file ]]; then
              errors=$(cat $file)
              errors="${errors//'%'/'%25'}"
              errors="${errors//$'\n'/'%0A'}"
              errors="${errors//$'\r'/'%0D'}"
              echo "::error file=${file}::$errors"
              exit=1
            fi
          done

          if [[ $exit == 1 ]]; then
            exit 1
          fi