Merge pull request #5804 from IntersectMBO/smelc/add-shellcheck-and-a…

…ctionlint-to-ci

CI: add shellcheck and actionlint

.github/workflows/actionlint-exceptions.txt

@@ -0,0 +1,4 @@
+.github/workflows/haskell.yml
+.github/workflows/release-ghcr.yaml
+.github/workflows/release-upload.yaml
+.github/workflows/stylish-haskell.yml

.github/workflows/actionlint.yml

@@ -0,0 +1,39 @@
+name: Actionlint
+
+on:
+  pull_request:
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # We want to install Nix to provision shellcheck, so that actionlint doesn't install
+      # its own shellcheck. This will also make sure that this pipeline runs using
+      # the same shellcheck as the ones in Nix shells of developers.
+      - name: Install Nix with good defaults
+        uses: input-output-hk/install-nix-action@v20
+        with:
+          extra_nix_config: |
+            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=
+            substituters = https://cache.nixos.org/ https://cache.iog.io/
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/install-nix-action@v18
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      # Make the Nix environment available to next steps
+      - uses: rrbutani/use-nix-shell-action@v1
+
+      - name: actionlint
+        run: |
+          for file in $(git ls-files ".github/workflows/*.y*ml")
+          do
+            if grep -q "$file" ".github/workflows/actionlint-exceptions.txt"
+            then
+              echo "⚠️ $file is ignored from actionlint's verifications. Please consider fixing it."
+            else
+              echo "actionlint $file"
+              actionlint "$file"
+            fi
+          done

.github/workflows/github-page.yml

@@ -50,7 +50,7 @@ jobs:
         tar -czf haddocks.tgz -C haddocks .
 
     - name: Upload haddocks artifact
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v4
       if: ${{ always() }}
       continue-on-error: true
       with:

.github/workflows/shellcheck-exceptions.txt

@@ -0,0 +1,60 @@
+.github/bin/haddocks.sh
+scripts/ci/check-cabal-files.sh
+bench/process/process.sh
+bench/script/probe.sh
+cardano-submit-api/test/run.sh
+cardano-tracer/demo/multi/run.sh
+cardano-tracer/demo/ssh/run.sh
+ci/check-dependencies-merged-to-master.sh
+ci/check-hydra.sh
+configuration/cardano/update-config-files.sh
+nix/regenerate.sh
+nix/workbench/analyse/analyse.sh
+nix/workbench/backend/backend.sh
+nix/workbench/backend/nomad.sh
+nix/workbench/backend/nomad/cloud.sh
+nix/workbench/backend/nomad/exec.sh
+nix/workbench/backend/nomad/podman.sh
+nix/workbench/backend/supervisor.sh
+nix/workbench/chaindb.sh
+nix/workbench/env.sh
+nix/workbench/lib-cabal.sh
+nix/workbench/lib.sh
+nix/workbench/manifest.sh
+nix/workbench/nomad.sh
+nix/workbench/profile/pparams/apiPparamsImport.sh
+nix/workbench/profile/pparams/diffLatest.sh
+nix/workbench/profile/pparams/diffLatestWithOverlay.sh
+nix/workbench/profile/pparams/pparamsLastWithOverlay.sh
+nix/workbench/profile/profile.sh
+nix/workbench/publish.sh
+nix/workbench/run.sh
+nix/workbench/scenario.sh
+nix/workbench/topology/topology.sh
+scripts/babbage/example-babbage-script-usage.sh
+scripts/babbage/mkfiles.sh
+scripts/babbage/script-context-equivalance-test.sh
+scripts/babbage/script-mint-context-equivalance-test.sh
+scripts/babbage/staking-example/claim-script-staking-rewards.sh
+scripts/babbage/staking-example/register-and-delegate-script-staking-address.sh
+scripts/bin-path.sh
+scripts/byron-to-alonzo/burn.sh
+scripts/byron-to-alonzo/mint.sh
+scripts/byron-to-alonzo/mkfiles.sh
+scripts/byron-to-alonzo/update-3.sh
+scripts/byron-to-alonzo/update-4.sh
+scripts/byron-to-alonzo/update-5.sh
+scripts/ci/check-cabal-files.sh
+scripts/gen-merge-summary.sh
+scripts/lite/example-build-cmd.sh
+scripts/lite/shelley-testnet-2.sh
+scripts/lite/shelley-testnet.sh
+scripts/lite/shutdown-ipc-example.sh
+scripts/lite/split-txouts.sh
+scripts/plutus/always-fails.sh
+scripts/plutus/example-txin-locking-plutus-script.sh
+scripts/plutus/script-context-equivalance-test.sh
+scripts/plutus/script-context-equivalence-test-minting.sh
+scripts/plutus/simple-minting-policy.sh
+scripts/plutus/staking-example/claim-script-staking-rewards.sh
+scripts/test-stake-cred-script/create-collateral.sh

.github/workflows/shellcheck.yml

@@ -0,0 +1,40 @@
+name: Shellcheck
+# This pipeline runs shellcheck on all files with extension .sh,
+# except the ones listed in .github/workflows/shellcheck-exceptions.txt.
+#
+# This pipeline uses Nix, so that the shellcheck version used is the same
+# ones as used by developers in Nix shells. This ensures the CI's behavior
+# is consistent with the one of developers.
+
+on:
+  pull_request:
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Nix with good defaults
+        uses: input-output-hk/install-nix-action@v20
+        with:
+          extra_nix_config: |
+            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=
+            substituters = https://cache.nixos.org/ https://cache.iog.io/
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/install-nix-action@v18
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      # Make the Nix environment available to next steps
+      - uses: rrbutani/use-nix-shell-action@v1
+      - name: shellcheck
+        run: |
+          for file in $(git ls-files "*.sh")
+          do
+            if grep -q "$file" ".github/workflows/shellcheck-exceptions.txt"
+            then
+              echo "⚠️ $file is ignored from shellcheck's verifications. Please consider fixing it."
+            else
+              echo "shellcheck $file"
+              shellcheck "$file"
+            fi
+          done

nix/haskell.nix

@@ -48,6 +48,8 @@ let
           ghcid
           haskell-language-server
           cabal
+          actionlint
+          shellcheck
         ];
 
         withHoogle = true;