@lvce-editor/eslint-plugin-github-actions 15.4.0 → 16.1.0

package/dist/index.js

@@ -14,15 +14,15 @@ const platforms = {
   windows: 'windows'
 };
 const actions = {
-  'actions/cache': ['actions/cache@v5'],
-  'actions/checkout': ['actions/checkout@v6'],
+  'actions/cache': ['actions/cache@v6'],
+  'actions/checkout': ['actions/checkout@v7'],
   'actions/create-release': ['actions/create-release@v1'],
-  'actions/deploy-pages': ['actions/deploy-pages@v4'],
-  'actions/download-artifact': ['actions/download-artifact@v7'],
+  'actions/deploy-pages': ['actions/deploy-pages@v5'],
+  'actions/download-artifact': ['actions/download-artifact@v8'],
   'actions/setup-node': ['actions/setup-node@v6'],
   'actions/setup-python': ['actions/setup-python@v6'],
-  'actions/upload-artifact': ['actions/upload-artifact@v6'],
-  'actions/upload-pages-artifact': ['actions/upload-pages-artifact@v4']
+  'actions/upload-artifact': ['actions/upload-artifact@v7'],
+  'actions/upload-pages-artifact': ['actions/upload-pages-artifact@v5']
 };
 const npmRegistries = ['https://registry.npmjs.org', 'https://npm.pkg.github.com'];
 const onProperties = ['push', 'pull_request'];
@@ -38,7 +38,7 @@ const permissions$1 = {
 const isSupported = (actions, value) => {
   return actions.includes(value);
 };
-const meta$g = {
+const meta$i = {
   docs: {
     description: 'Disallow unsupported action versions'
   },
@@ -48,7 +48,7 @@ const meta$g = {
   },
   type: 'problem'
 };
-const create$g = context => {
+const create$i = context => {
   const sourceCode = getSourceCode(context);
   if (!sourceCode.parserServices?.isYAML) {
     return {};
@@ -79,8 +79,8 @@ const create$g = context => {
 
 const actionVersions = {
   __proto__: null,
-  create: create$g,
-  meta: meta$g
+  create: create$i,
+  meta: meta$i
 };
 
 const parseVersion = value => {
@@ -104,7 +104,7 @@ const isSupportedMacosversion = version => {
 const isSupportedWindowsVersion = version => {
   return config.windows.includes(version);
 };
-const meta$f = {
+const meta$h = {
   docs: {
     description: 'Disallow unsupported ci versions'
   },
@@ -113,7 +113,7 @@ const meta$f = {
   },
   type: 'problem'
 };
-const create$f = context => {
+const create$h = context => {
   const sourceCode = getSourceCode(context);
   if (!sourceCode.parserServices?.isYAML) {
     return {};
@@ -157,11 +157,11 @@ const create$f = context => {
 
 const ciVersions = {
   __proto__: null,
-  create: create$f,
-  meta: meta$f
+  create: create$h,
+  meta: meta$h
 };
 
-const meta$e = {
+const meta$g = {
   docs: {
     description: 'Disallow unsupported fail fast values'
   },
@@ -170,7 +170,7 @@ const meta$e = {
   },
   type: 'problem'
 };
-const create$e = context => {
+const create$g = context => {
   const sourceCode = getSourceCode(context);
   if (!sourceCode.parserServices?.isYAML) {
     return {};
@@ -193,11 +193,108 @@ const create$e = context => {
 
 const failFast = {
   __proto__: null,
-  create: create$e,
-  meta: meta$e
+  create: create$g,
+  meta: meta$g
 };
 
-const meta$d = {
+const meta$f = {
+  docs: {
+    description: 'Require GitHub Pages deployment best practices'
+  },
+  messages: {
+    missingGithubPagesConcurrency: 'GitHub Pages deployment requires concurrency group pages with cancel-in-progress false',
+    missingGithubPagesPermissions: 'GitHub Pages deployment requires contents read, pages write, and id-token write permissions'
+  },
+  type: 'problem'
+};
+const isCiWorkflow = fileName => {
+  return fileName.endsWith('/ci.yml') || fileName.endsWith('/ci.yaml') || fileName.endsWith('\\ci.yml') || fileName.endsWith('\\ci.yaml');
+};
+const isYamlScalarString = (node, value) => {
+  return node?.type === 'YAMLScalar' && node.value === value;
+};
+const isYamlScalarBoolean = (node, value) => {
+  return node?.type === 'YAMLScalar' && node.value === value;
+};
+const isDeployPagesAction = node => {
+  return node?.type === 'YAMLScalar' && typeof node.value === 'string' && node.value.startsWith('actions/deploy-pages@');
+};
+const isTopLevelPair = node => {
+  return node.parent?.parent?.type === 'YAMLDocument';
+};
+const getMappingValue = (mapping, key) => {
+  for (const pair of mapping.pairs) {
+    if (pair.key?.type === 'YAMLScalar' && pair.key.value === key) {
+      return pair.value;
+    }
+  }
+  return null;
+};
+const hasGithubPagesPermissions = mapping => {
+  if (!mapping) {
+    return false;
+  }
+  return isYamlScalarString(getMappingValue(mapping, 'contents'), 'read') && isYamlScalarString(getMappingValue(mapping, 'pages'), 'write') && isYamlScalarString(getMappingValue(mapping, 'id-token'), 'write');
+};
+const hasGithubPagesConcurrency = mapping => {
+  if (!mapping) {
+    return false;
+  }
+  return isYamlScalarString(getMappingValue(mapping, 'group'), 'pages') && isYamlScalarBoolean(getMappingValue(mapping, 'cancel-in-progress'), false);
+};
+const create$f = context => {
+  const sourceCode = getSourceCode(context);
+  if (!sourceCode.parserServices?.isYAML || !isCiWorkflow(context.filename)) {
+    return {};
+  }
+  let deployPagesNode;
+  let permissions;
+  let concurrency;
+  return {
+    'Program:exit'() {
+      if (!deployPagesNode) {
+        return;
+      }
+      if (!hasGithubPagesPermissions(permissions)) {
+        context.report({
+          messageId: 'missingGithubPagesPermissions',
+          node: deployPagesNode
+        });
+      }
+      if (!hasGithubPagesConcurrency(concurrency)) {
+        context.report({
+          messageId: 'missingGithubPagesConcurrency',
+          node: deployPagesNode
+        });
+      }
+    },
+    YAMLPair(node) {
+      if (!node.key || node.key.type !== 'YAMLScalar' || typeof node.key.value !== 'string') {
+        return;
+      }
+      if (node.key.value === 'uses' && isDeployPagesAction(node.value)) {
+        deployPagesNode = node;
+        return;
+      }
+      if (!isTopLevelPair(node) || node.value?.type !== 'YAMLMapping') {
+        return;
+      }
+      if (node.key.value === 'permissions') {
+        permissions = node.value;
+      } else if (node.key.value === 'concurrency') {
+        concurrency = node.value;
+      }
+    }
+  };
+};
+
+const githubPages = {
+  __proto__: null,
+  create: create$f,
+  meta: meta$f
+};
+
+const meta$e = {
   docs: {
     description: 'Disallow unsupported github token values'
   },
@@ -206,7 +303,7 @@ const meta$d = {
   },
   type: 'problem'
 };
-const create$d = context => {
+const create$e = context => {
   const sourceCode = getSourceCode(context);
   if (!sourceCode.parserServices?.isYAML) {
     return {};
@@ -231,11 +328,11 @@ const create$d = context => {
 
 const githubToken = {
   __proto__: null,
-  create: create$d,
-  meta: meta$d
+  create: create$e,
+  meta: meta$e
 };
 
-const meta$c = {
+const meta$d = {
   docs: {
     description: 'Disallow unsupported matrix values'
   },
@@ -244,7 +341,7 @@ const meta$c = {
   },
   type: 'problem'
 };
-const create$c = context => {
+const create$d = context => {
   const sourceCode = getSourceCode(context);
   if (!sourceCode.parserServices?.isYAML) {
     return {};
@@ -267,11 +364,11 @@ const create$c = context => {
 
 const matrix = {
   __proto__: null,
-  create: create$c,
-  meta: meta$c
+  create: create$d,
+  meta: meta$d
 };
 
-const meta$b = {
+const meta$c = {
   docs: {
     description: 'Disallow unsupported max parallel values'
   },
@@ -280,7 +377,7 @@ const meta$b = {
   },
   type: 'problem'
 };
-const create$b = context => {
+const create$c = context => {
   const sourceCode = getSourceCode(context);
   if (!sourceCode.parserServices?.isYAML) {
     return {};
@@ -303,11 +400,11 @@ const create$b = context => {
 
 const maxParallel = {
   __proto__: null,
-  create: create$b,
-  meta: meta$b
+  create: create$c,
+  meta: meta$c
 };
 
-const meta$a = {
+const meta$b = {
   docs: {
     description: 'Disallow unsupported needs values'
   },
@@ -340,7 +437,7 @@ const getValidNeeds = node => {
   }
   return validNeeds;
 };
-const create$a = context => {
+const create$b = context => {
   const sourceCode = getSourceCode(context);
   if (!sourceCode.parserServices?.isYAML) {
     return {};
@@ -398,6 +495,57 @@ const create$a = context => {
 };
 
 const needs = {
+  __proto__: null,
+  create: create$b,
+  meta: meta$b
+};
+
+const meta$a = {
+  docs: {
+    description: 'Disallow e2e tests in release workflows'
+  },
+  messages: {
+    noE2eInRelease: 'Do not run e2e tests in release workflows'
+  },
+  type: 'problem'
+};
+const isReleaseWorkflow = filename => {
+  const normalized = filename.replaceAll('\\', '/');
+  return normalized.endsWith('/release.yml') || normalized.endsWith('/release.yaml') || normalized === 'release.yml' || normalized === 'release.yaml';
+};
+const runsE2eTests = value => {
+  const commands = value.replaceAll('\r', '\n').replaceAll('&&', ';').replaceAll('||', ';').split(/[\n;]/);
+  for (const command of commands) {
+    const tokens = command.trim().split(/\s+/);
+    const npmIndex = tokens.indexOf('npm');
+    if (npmIndex === -1) {
+      continue;
+    }
+    const scriptName = tokens[npmIndex + 2];
+    if (tokens[npmIndex + 1] === 'run' && (scriptName === 'e2e' || scriptName?.startsWith('e2e:'))) {
+      return true;
+    }
+  }
+  return false;
+};
+const create$a = context => {
+  const sourceCode = getSourceCode(context);
+  if (!sourceCode.parserServices?.isYAML || !isReleaseWorkflow(context.filename)) {
+    return {};
+  }
+  return {
+    YAMLPair(node) {
+      if (node && node.type === 'YAMLPair' && node.key && typeof node.key === 'object' && 'type' in node.key && node.key.type === 'YAMLScalar' && node.key.value === 'run' && node.value && typeof node.value === 'object' && 'type' in node.value && node.value.type === 'YAMLScalar' && typeof node.value.value === 'string' && runsE2eTests(node.value.value)) {
+        context.report({
+          messageId: 'noE2eInRelease',
+          node: node.value
+        });
+      }
+    }
+  };
+};
+
+const noE2eInRelease = {
   __proto__: null,
   create: create$a,
   meta: meta$a
@@ -862,10 +1010,12 @@ const plugin = {
     'action-versions': actionVersions,
     'ci-versions': ciVersions,
     'fail-fast': failFast,
+    'github-pages': githubPages,
     'github-token': githubToken,
     matrix: matrix,
     'max-parallel': maxParallel,
     needs: needs,
+    'no-e2e-in-release': noE2eInRelease,
     'node-version-file': nodeVersionFile,
     npm: npm,
     'npm-registry': npmRegistry,
@@ -890,10 +1040,12 @@ const recommended = [{
     'github-actions/action-versions': 'error',
     'github-actions/ci-versions': 'error',
     'github-actions/fail-fast': 'error',
+    'github-actions/github-pages': 'error',
     'github-actions/github-token': 'error',
     'github-actions/matrix': 'off',
     'github-actions/max-parallel': 'error',
     'github-actions/needs': 'error',
+    'github-actions/no-e2e-in-release': 'error',
     'github-actions/node-version-file': 'error',
     'github-actions/npm': 'error',
     'github-actions/npm-registry': 'error',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lvce-editor/eslint-plugin-github-actions",
-  "version": "15.4.0",
+  "version": "16.1.0",
   "main": "dist/index.js",
   "type": "module",
   "license": "MIT",