validate-workflow-files.yaml

name: Workflow YAML check
# This performs fairly detailed checks on all the .yaml workflow definitions
# Note that without this, a single minor mistake in a workflow YAML
# will cause github to (almost) SILENTLY FAIL.  It will:
# - Not run any part of the workflow
# - Not even report that there was an error in the file
# - Show a hard-to-find failure in the "Actions" tab of the repo.
# This could cause a key set of checks to not run, and thus an important
# error to slip by unnoticed.

on:
  pull_request:
    paths:
      - '.github/workflows/*.yaml'
      - '.github/*.yaml'
    types: [opened, synchronize, reopened]
  push:
    branches:
      - main
    paths:
      - '.github/workflows/*.yaml'
      - '.github/*.yaml'

jobs:
  check-workflow-files:
    runs-on: ubuntu-22.04

    defaults:
      run:
        working-directory: .github/workflows

    steps:
      - name: Check out code
        uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.12'

      - name: Install yamllint
        run: |
          python -m pip install --upgrade pip
          pip install yamllint

      - name: Run yamllint
        run: yamllint -c ../.yamllint.yaml *.yaml

      - name: Set up Golang
        uses: actions/setup-go@v4
        with:
          go-version: "1.21"

      - name: Install actionlint
        run: |
          go install github.com/rhysd/actionlint/cmd/actionlint@latest
          echo "${HOME}/go/bin" >> $GITHUB_PATH

      - name: Run actionlint looking for serious errors
        # Actionlint can't find the config file if it's not run from the root
        working-directory: .
        run: actionlint -oneline

      - name: Run actionlint loosely for warnings
        working-directory: .
        run: |
          # Delete all the "ignore" lines in the actionlint.yaml file
          sed -i '/^paths:/,$d' .github/actionlint.yaml
          actionlint -oneline || echo "actionlint has non-critical warnings"