ci: add code quality workflow

.github/workflows/main.yml

@@ -219,3 +219,64 @@ jobs:
             ./report/**/*.xml
           event_name: ${{ github.event.workflow_run.event }}
           report_individual_runs: "true"
+
+  codestyle_all_without_ruff:
+    runs-on: [self-hosted, linux, light]
+    needs: gh_build_image
+    container:
+      # until https://github.com/github/docs/issues/25520 is resolved, using vars
+      image: "ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}/datalens_ci_with_code:${{ github.sha }}"
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: 'Cleanup build folder'
+        run: |
+          rm -rf ./* || true
+          rm -rf ./.??* || true
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          submodules: true
+      - run: |
+          task cq:check_dir -- .
+          task cq:check_dir_strict -- .
+        env:
+          VENV_PATH: /venv
+          SKIP_RUFF: true
+
+  codestyle_changed_without_ruff:
+    runs-on: [ self-hosted, linux, light ]
+    needs: gh_build_image
+    container:
+      # until https://github.com/github/docs/issues/25520 is resolved, using vars
+      image: "ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}/datalens_ci_with_code:${{ github.sha }}"
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: 'Cleanup build folder'
+        run: |
+          rm -rf ./* || true
+          rm -rf ./.??* || true
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: true
+      # https://github.com/actions/runner-images/issues/6775
+      - run: git config --global --add safe.directory .
+      - run: git config --global --add safe.directory /__w/${{ github.event.repository.name }}/${{ github.event.repository.name }}
+      - run: |
+          TARGET=$(. /venv/bin/activate && dl-git range-diff-paths --only-added-commits --base ${{ github.event.pull_request.base.sha }} --head ${{ github.event.pull_request.head.sha }})
+          echo $TARGET
+      - run: |
+          TARGET=$(. /venv/bin/activate && dl-git range-diff-paths --only-added-commits --base ${{ github.event.pull_request.base.sha }} --head ${{ github.event.pull_request.head.sha }})
+          echo $TARGET
+          task cq:check_target -- "$TARGET"
+          task cq:check_target_strict  -- "$TARGET" 1>/dev/null 2>/dev/null
+        env:
+          VENV_PATH: /venv
+          SKIP_RUFF: true
+          TEST_TARGET_OVERRIDE: ${{ github.event.inputs.test_targets }}

ci/build_naive.sh

@@ -12,6 +12,7 @@ DKR_IMG_REPO_PREFIX=${DKR_IMG_REPO_PREFIX:-"ghcr.io/${REPO_OWNER}/${REPO_NAME}"}
 # Internal constants
 BAKE_TARGET_BASE_CI="base_ci"
 BAKE_TARGET_CI_W_SRC="ci_with_src"
+BAKE_TARGET_CI_CODE_QUALITY="ci_code_quality"
 BAKE_EXECUTABLE="${ROOT_DIR}/docker_build/run-project-bake"
 
 # Will be used as base image for ci_with_src
@@ -21,6 +22,7 @@ DKR_IMG_CACHED_TARGET_DL_CI_BASE="${DKR_IMG_REPO_PREFIX}/datalens_base_ci:$(bash
 
 # CI image with all sources will be pushed here
 DKR_IMG_TARGET_DL_CI_WITH_SRC="${DKR_IMG_REPO_PREFIX}/datalens_ci_with_code:${GIT_SHA}"
+DKR_IMG_TARGET_DL_CI_CODE_QUALITY="${DKR_IMG_REPO_PREFIX}/datalens_ci_code_quality:${GIT_SHA}"
 
 set +x
 
@@ -47,6 +49,12 @@ DL_B_EXT_CACHED_TARGET_BASE_CI="${DKR_IMG_CACHED_TARGET_DL_CI_BASE}" \
   --progress=plain \
   --push
 
+echo "Building & pushing CI docker image with sources"
+"${BAKE_EXECUTABLE}" "${BAKE_TARGET_CI_CODE_QUALITY}" \
+  --set "${BAKE_TARGET_CI_CODE_QUALITY}.tags=${DKR_IMG_TARGET_DL_CI_CODE_QUALITY}" \
+  --progress=plain \
+  --push
+
 ## Building images with bake
 #export BASE_CI_TAG_OVERRIDE=$BASE_IMG_CR
 ## bash docker_build/run-project-bake ci_with_src ci_mypy

docker_build/bake_ci.hcl

@@ -42,3 +42,22 @@ target "ci_with_src" {
     "RUN . /venv/bin/activate && pip install -r /src/ci/requirements_types.txt"
   ])
 }
+
+target "ci_code_quality" {
+  contexts = {
+    base_img = "target:ci_with_src"
+  }
+  dockerfile-inline = <<EOT
+FROM base_img
+RUN export DEBIAN_FRONTEND=noninteractive && \
+  apt-get update && \
+  apt-get install --yes curl gpg ca-certificates wget && \
+  cd /tmp/ && wget https://github.com/go-task/task/releases/download/v3.29.1/task_linux_amd64.deb && \
+  echo "e411770abf73d5e094100ab7a1c8278f35b591ecadbfd778200b6b2ad1ee340b task_linux_amd64.deb" | sha256sum -c - && \
+  dpkg -i task_linux_amd64.deb && \
+  apt-get clean && \
+  rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+COPY
+RUN . /venv/bin/activate && pip install --no-deps -r /src/tools/requirements-localhost.txt
+EOT
+}