87 lines
2.8 KiB
YAML
87 lines
2.8 KiB
YAML
name: Check automated documentation is up-to-date
|
|
|
|
# This action is used to check that auto-generated documentation is up-to-date.
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
paths:
|
|
- "**.go"
|
|
- ".github/workflows/check-automated-doc.yml"
|
|
- "schema/tables/**"
|
|
- "schema/osquery_fleet_schema.json"
|
|
workflow_dispatch: # Manual
|
|
|
|
# This allows a subsequently queued workflow run to interrupt previous runs
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
defaults:
|
|
run:
|
|
# fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
|
|
shell: bash
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
# Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
|
|
NPM_CONFIG_MIN_RELEASE_AGE: 0.5
|
|
|
|
jobs:
|
|
check-doc-gen:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout Code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install Go
|
|
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
|
|
- name: Verify golang generated documentation is up-to-date
|
|
run: |
|
|
make generate-doc
|
|
if [[ $(git diff) ]]; then
|
|
echo "❌ fail: uncommitted changes"
|
|
echo "please run 'make generate-doc' and commit the changes"
|
|
git --no-pager diff
|
|
exit 1
|
|
fi
|
|
|
|
- name: Verify osquery table JSON schema is up-to-date
|
|
run: |
|
|
cd website
|
|
# npm ci (not npm install) so npm never rewrites package-lock.json:
|
|
# newer npm records packages shipped inside dependency tarballs (e.g.
|
|
# sails-hook-grunt) as "extraneous" lockfile entries, causing spurious drift.
|
|
npm ci
|
|
./node_modules/sails/bin/sails.js run generate-merged-schema
|
|
if [[ $(git diff) ]]; then
|
|
echo "❌ fail: uncommitted changes"
|
|
echo "please run 'cd website && npm ci && ./node_modules/sails/bin/sails.js run generate-merged-schema' and commit the changes"
|
|
git --no-pager diff
|
|
exit 1
|
|
fi
|
|
|
|
- name: Verify VEX report is up-to-date
|
|
run: |
|
|
make vex-report
|
|
if [[ $(git diff) ]]; then
|
|
echo "❌ fail: uncommitted changes"
|
|
echo "please run 'make vex-report' and commit the changes"
|
|
git --no-pager diff
|
|
exit 1
|
|
fi
|