Skip to content

ci: add actionlint, zizmor, and oxfmt checks #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sou1118 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: add actionlint, zizmor, and oxfmt checks #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,19 +36,43 @@ jobs:
cache: true
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
with:
install_args: rust
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
if: ${{ matrix.cache }}
- run: ${{ matrix.command }}

workflow-lint:
name: Workflow Lint
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
with:
install_args: actionlint zizmor aqua:oxc-project/oxc/oxfmt
- name: actionlint
run: actionlint
- name: zizmor
run: zizmor .github/workflows/

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- workflow context ---'
sed -n '45,75p' .github/workflows/ci.yml
printf '%s\n' '--- zizmor references ---'
rg -n -i 'zizmor|strict-collection' .github README.md 2>/dev/null || true
printf '%s\n' '--- pinned documentation option ---'
curl -fsSL --max-time 20 https://raw.githubusercontent.com/zizmorcore/zizmor/v1.28.0/docs/usage.md \
  | rg -n -C 4 -- '--strict-collection|strict.collection|collection'

Repository: sou1118/typdiff

Length of output: 3257

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- all tracked version/config references ---'
rg -n -i 'zizmor|mise|aqua' --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' . || true

printf '%s\n' '--- v1.28.0 source tree candidates ---'
curl -fsSL --max-time 20 \
  'https://api.github.com/repos/zizmorcore/zizmor/git/trees/v1.28.0?recursive=1' \
  | jq -r '.tree[] | select(.path | test("src/|Cargo.toml|CHANGELOG|release"; "i")) | .path' \
  | head -200

printf '%s\n' '--- tagged source references ---'
for path in \
  src/cli.rs \
  src/main.rs \
  src/args.rs \
  src/collection.rs \
  src/inputs.rs
do
  url="https://raw.githubusercontent.com/zizmorcore/zizmor/v1.28.0/$path"
  body="$(curl -fsSL --max-time 20 "$url" 2>/dev/null || true)"
  if [ -n "$body" ]; then
    printf '%s\n' "--- $path ---"
    printf '%s\n' "$body" | rg -n -C 5 'strict.collection|strict-collection|parse.*fail|collection' || true
  fi
done

Repository: sou1118/typdiff

Length of output: 5468

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- version configuration ---'
cat -n mise.toml

for path in crates/zizmor/src/cli.rs crates/zizmor/src/main.rs crates/zizmor/src/models/inputs.rs; do
  printf '%s\n' "--- $path ---"
  curl -fsSL --max-time 20 \
    "https://raw.githubusercontent.com/zizmorcore/zizmor/v1.28.0/$path" \
    | rg -n -C 8 'strict.collection|strict-collection|collection|parse' || true
done

printf '%s\n' '--- relevant tagged source declarations ---'
for path in crates/zizmor/src/cli.rs crates/zizmor/src/main.rs; do
  curl -fsSL --max-time 20 \
    "https://raw.githubusercontent.com/zizmorcore/zizmor/v1.28.0/$path" \
    | rg -n 'struct|enum|strict|collect|parse|exit|Error' || true
done

Repository: sou1118/typdiff

Length of output: 14596

🏁 Script executed:

#!/bin/bash
set -eu
path=crates/zizmor/src/registry/input.rs
curl -fsSL --max-time 20 \
  "https://raw.githubusercontent.com/zizmorcore/zizmor/v1.28.0/$path" \
  > /tmp/zizmor-input-v1.28.0.rs
printf '%s\n' '--- collector structure ---'
rg -n -C 12 'strict|parse|warn|Syntax|Schema|CollectionError|collect' /tmp/zizmor-input-v1.28.0.rs

printf '%s\n' '--- standalone semantic check ---'
python3 - <<'PY'
from pathlib import Path
s = Path('/tmp/zizmor-input-v1.28.0.rs').read_text()
needles = [
    'if options.strict',
    'tracing::warn!',
    'CollectionError',
]
for needle in needles:
    print(f'{needle}: {s.count(needle)} occurrence(s)')
assert 'if options.strict' in s
assert 'tracing::warn!' in s
print('The collector has separate strict and warning branches.')
PY

Repository: sou1118/typdiff

Length of output: 23875

🏁 Script executed:

#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
s = Path('/tmp/zizmor-input-v1.28.0.rs').read_text()

syntax = re.search(
    r'Err\(CollectionError::Syntax\(e\)\) if !strict:\s*\{(?P<body>.*?)\n\s*\}\n'
    r'\s*Err\(e @ CollectionError::Schema',
    s, re.S,
)
schema = re.search(
    r'Err\(e @ CollectionError::Schema \{ \.\. \}\) if !strict:\s*\{(?P<body>.*?)\n\s*\}\n'
    r'\s*Err\(e\) => Err\(CollectionError::Inner',
    s, re.S,
)
assert syntax and 'tracing::warn!' in syntax.group('body') and 'Ok(())' in syntax.group('body')
assert schema and 'tracing::warn!' in schema.group('body') and 'Ok(())' in schema.group('body')
assert 'Err(e) => Err(CollectionError::Inner' in s
print('v1.28.0 collector behavior: non-strict syntax/schema errors warn and return Ok(()); strict errors return Err.')

main = Path('/tmp/zizmor-main-v1.28.0.rs')
if not main.exists():
    import urllib.request
    main.write_bytes(urllib.request.urlopen(
        'https://raw.githubusercontent.com/zizmorcore/zizmor/v1.28.0/crates/zizmor/src/main.rs',
        timeout=20,
    ).read())
m = main.read_text()
exit_block = re.search(r'Error::Collection\(err\).*?let exit = if .*?;\s*exit', m, re.S)
assert exit_block
assert 'ExitCode::FAILURE' in exit_block.group()
print('v1.28.0 CLI maps collection errors to a failing process exit.')
PY

Repository: sou1118/typdiff

Length of output: 242

🏁 Script executed:

#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re, urllib.request

src = Path('/tmp/zizmor-input-v1.28.0.rs').read_text()
for variant in ('Syntax', 'Schema'):
    pattern = rf'Err\(.*CollectionError::{variant}.*\) if !strict\s*=>\s*\{{(?P<body>.*?)\n\s*\}}\n'
    match = re.search(pattern, src, re.S)
    assert match, variant
    body = match.group('body')
    assert 'tracing::warn!' in body and 'Ok(())' in body, variant
assert re.search(r'Err\(e\) => Err\(CollectionError::Inner', src)
print('v1.28.0: non-strict syntax/schema collection errors warn and return Ok(()); strict errors return Err.')

main = Path('/tmp/zizmor-main-v1.28.0.rs')
main.write_bytes(urllib.request.urlopen(
    'https://raw.githubusercontent.com/zizmorcore/zizmor/v1.28.0/crates/zizmor/src/main.rs',
    timeout=20,
).read())
m = main.read_text()
assert 'Error::Collection(err)' in m
assert re.search(r'let exit = if .*?ExitCode::FAILURE', m, re.S)
print('v1.28.0: collection errors map to a failing process exit.')
PY

Repository: sou1118/typdiff

Length of output: 2542

🏁 Script executed:

#!/bin/bash
set -eu
curl -fsSL --max-time 20 \
  https://raw.githubusercontent.com/zizmorcore/zizmor/v1.28.0/crates/zizmor/src/main.rs \
  | sed -n '585,615p'

Repository: sou1118/typdiff

Length of output: 866

Add --strict-collection to the zizmor step.

When a collected input has syntax or schema errors, zizmor 1.28.0 warns and skips it unless strict collection is enabled. Run zizmor --strict-collection .github/workflows/.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 62, Update the zizmor workflow step to
enable strict collection by adding the --strict-collection option while
preserving the existing .github/workflows/ target.

env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: oxfmt
run: oxfmt --check .

compile-test:
name: Compile Test
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
- name: Build typdiff
Expand Down
10 changes: 9 additions & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ on:
workflow_dispatch:

permissions:
contents: write
contents: read

env:
CARGO_TERM_COLOR: always
Expand Down Expand Up @@ -38,9 +38,12 @@ jobs:
cross: false
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
with:
install_args: rust
cache: false
- name: Add build target
if: "!matrix.cross"
run: rustup target add ${{ matrix.target }}
Expand Down Expand Up @@ -75,6 +78,8 @@ jobs:
needs: build
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
contents: write
steps:
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
Expand All @@ -98,9 +103,12 @@ jobs:
contents: read
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
with:
install_args: rust
cache: false
- name: Authenticate with crates.io
id: auth
uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
Expand Down
5 changes: 5 additions & 0 deletions .github/zizmor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
rules:
superfluous-actions:
ignore:
# action-gh-release is kept for generate_release_notes and asset handling.
- release.yml
4 changes: 4 additions & 0 deletions mise.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
[tools]
rust = { version = "1.97.1", components = "rustfmt,clippy" }
typst = "0.15.1"
actionlint = "1.7.12"
zizmor = "1.28.0"
# apps_v* release tag of the oxc monorepo; ships oxfmt 0.62.0
"aqua:oxc-project/oxc/oxfmt" = "1.77.0"
6 changes: 1 addition & 5 deletions renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,6 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:best-practices",
":timezone(Asia/Tokyo)",
"schedule:weekly"
],
"extends": ["config:best-practices", ":timezone(Asia/Tokyo)", "schedule:weekly"],
"minimumReleaseAge": "7 days",
"lockFileMaintenance": {
"enabled": true
Expand Down