👷(ci) run the static checks before a run is approved

.github/workflows/meet.yml → .github/workflows/build-and-test.yml

@@ -1,4 +1,4 @@
-name: meet Workflow
+name: build and test
 
 on:
   push:
@@ -11,63 +11,6 @@
   contents: read
 
 jobs:
-  lint-git:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' # Makes sense only for pull requests
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-      - name: show
-        run: git log
-      - name: Enforce absence of print statements in code
-        if: always()
-        run: |
-          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude)**/meet.yml' | grep "print("
-      - name: Check absence of fixup commits
-        if: always()
-        run: |
-          ! git log | grep 'fixup!'
-      - name: Install gitlint
-        if: always()
-        run: pip install --user requests gitlint
-      - name: Lint commit messages added to main
-        if: always()
-        run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
-
-  check-changelog:
-    runs-on: ubuntu-latest
-    if: |
-      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
-      github.event_name == 'pull_request'
-    permissions:
-        contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 50
-      - name: Check that the CHANGELOG has been modified in the current branch
-        run: git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.after }} | grep 'CHANGELOG.md'
-
-  lint-changelog:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-      - name: Check CHANGELOG max line length
-        run: |
-          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
-          if [ $max_line_length -ge 80 ]; then
-            echo "ERROR: CHANGELOG has lines longer than 80 characters."
-            exit 1
-          fi
-
   build-mails:
     runs-on: ubuntu-latest
     permissions:
@@ -93,11 +36,11 @@
 
       - name: Install yarn
         if: steps.mail-templates.outputs.cache-hit != 'true'
         run: npm install -g yarn
 
       - name: Install node dependencies
         if: steps.mail-templates.outputs.cache-hit != 'true'
         run: yarn install --frozen-lockfile
 
       - name: Build mails
         if: steps.mail-templates.outputs.cache-hit != 'true'
@@ -125,16 +68,16 @@
         with:
           python-version: "3.13"
       - name: Install uv
         uses: astral-sh/setup-uv@v7
       - name: Install the project
         run: uv sync --locked --all-extras
 
       - name: Check code formatting with ruff
         run: uv run ruff format . --diff
       - name: Lint code with ruff
         run: uv run ruff check .
       - name: Lint code with pylint
         run: uv run pylint meet demo core
 
   lint-agents:
     runs-on: ubuntu-latest
@@ -151,13 +94,13 @@
         with:
           python-version: "3.13"
       - name: Install uv
         uses: astral-sh/setup-uv@v7
       - name: Install the project
         run: uv sync --locked --all-extras
       - name: Check code formatting with ruff
         run: uv run ruff format . --diff
       - name: Lint code with ruff
         run: uv run ruff check .
 
   lint-summary:
     runs-on: ubuntu-latest
@@ -175,7 +118,7 @@
           python-version: "3.13"
           cache: "pip"
       - name: Install development dependencies
         run: pip install --user .[dev]
       - name: Check code formatting with ruff
         run: ~/.local/bin/ruff format . --diff
       - name: Lint code with ruff
@@ -262,7 +205,7 @@
       # Tool to wait for a service to be ready
       - name: Install Dockerize
         run: |
           curl -sSL https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz | sudo tar -C /usr/local/bin -xzv
 
       - name: Wait for MinIO to be ready
         run: |
@@ -281,9 +224,9 @@
         with:
           python-version: "3.13"
       - name: Install uv
         uses: astral-sh/setup-uv@v7
       - name: Install the dependencies
         run: uv sync --locked --all-extras
 
       - name: Install gettext (required to compile messages)
         run: |
@@ -291,10 +234,10 @@
           sudo apt-get install -y gettext
 
       - name: Generate a MO file from strings extracted from the project
         run: uv run python manage.py compilemessages
 
       - name: Run tests
         run: uv run pytest -n 2
 
   test-summary:
     runs-on: ubuntu-latest
@@ -334,7 +277,7 @@
           cache: "pip"
 
       - name: Install development dependencies
         run: pip install --user .[dev]
 
       - name: Run summary tests
         run: ~/.local/bin/pytest
@@ -348,14 +291,11 @@
         uses: actions/checkout@v6
 
       - name: Install dependencies
         run: cd src/frontend/ && npm ci
 
       - name: Check linting
         run: cd src/frontend/ && npm run lint
 
-      - name: Check format
-        run: cd src/frontend/ && npm run check
-
   lint-sdk:
     runs-on: ubuntu-latest
     permissions:
@@ -368,7 +308,7 @@
         uses: actions/checkout@v6
 
       - name: Install dependencies
         run: npm ci
 
       - name: Check linting
         run: npm run lint
@@ -389,7 +329,7 @@
         uses: actions/checkout@v6
 
       - name: Install dependencies
         run: npm ci
 
       - name: Build SDK
         run: npm run build

.github/workflows/static-checks.yml

@@ -0,0 +1,139 @@
+name: static checks
+
+# The checks that read a branch rather than execute it. They live here, and not
+# in build-and-test.yml, so they report on a pull request from a first-time
+# contributor, whose pull_request run waits for a maintainer to approve it. On
+# a push to main, the two that read a commit rather than a pull request run
+# over what was pushed.
+#
+# pull_request_target runs with this repository's token, so nothing the branch
+# controls may be installed, imported or executed here. Do not add a step that
+# builds or tests it: that needs pull_request, and the wait that comes with it.
+# https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
+
+on:
+  push:
+    branches:
+      - main
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - labeled
+      - unlabeled
+
+# every job below grants itself what it needs, so a job added without a block
+# gets nothing rather than the repository default
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  HEAD_REF: refs/pull/${{ github.event.pull_request.number }}/head
+
+jobs:
+  check-format:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      # persist-credentials keeps this repository's token out of .git/config,
+      # which the branch's own files land beside
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: src/frontend/package-lock.json
+      - name: Install dependencies
+        run: cd src/frontend/ && npm ci --ignore-scripts
+      - name: Read the branch's sources as data
+        if: github.event_name == 'pull_request_target'
+        run: |
+          git fetch --no-tags --depth 1 origin "$HEAD_REF"
+          rm -rf src/frontend/src
+          git checkout FETCH_HEAD -- src/frontend/src
+      # without --config prettier loads one the branch left among its own files,
+      # and without --no-editorconfig an .editorconfig left there moves printWidth
+      # and tabWidth, which .prettierrc does not set and so cannot override
+      - name: Check format
+        run: cd src/frontend/ && npm run check -- --config .prettierrc --no-editorconfig
+
+  lint-changelog:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Read the branch's changelog as data
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REF: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          gh api -H 'Accept: application/vnd.github.raw' \
+            "repos/${{ github.repository }}/contents/CHANGELOG.md?ref=$REF" \
+            > CHANGELOG.md
+      - name: Check CHANGELOG max line length
+        run: |
+          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
+          if [ $max_line_length -ge 80 ]; then
+            echo "ERROR: CHANGELOG has lines longer than 80 characters."
+            exit 1
+          fi
+
+  check-changelog:
+    if: |
+      github.event_name == 'pull_request_target' &&
+      contains(github.event.pull_request.labels.*.name, 'noChangelog') == false
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      # unanchored, so a path ending in CHANGELOG.md anywhere counts
+      - name: Check that the CHANGELOG has been modified in the current branch
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api --paginate \
+            "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" \
+            --jq '.[].filename' | grep 'CHANGELOG.md'
+
+  lint-git:
+    if: github.event_name == 'pull_request_target'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      BASE_REF: ${{ github.event.pull_request.base.ref }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+      - name: Read the branch's commits as data
+        run: git fetch --no-tags origin "$HEAD_REF"
+      # added lines only, since deleting a print is not a violation, and the
+      # pattern is spelled so that this line does not match itself
+      - name: Enforce absence of print statements in code
+        if: always()
+        run: |
+          ! git diff "origin/$BASE_REF...FETCH_HEAD" | grep '^+.*print[(]'
+      - name: Check absence of fixup commits
+        if: always()
+        run: |
+          ! git log "origin/$BASE_REF..FETCH_HEAD" | grep 'fixup!'
+      - name: Install gitlint
+        if: always()
+        run: "pip install --user --only-binary=:all: requests==2.34.2 gitlint==0.18.0"
+      # gitlint imports gitlint/, so those rules must come from this checkout
+      - name: Lint commit messages added to main
+        if: always()
+        run: ~/.local/bin/gitlint --commits "origin/$BASE_REF..FETCH_HEAD"