safer-golangci-lint.yml

# Copyright © 2021-2023 Montgomery Edwards⁴⁴⁸ (github.com/x448).
# This file is licensed under MIT License.
#
# Safer GitHub Actions Workflow for golangci-lint.
# https://github.com/x448/safer-golangci-lint 
#
name: linters

# Remove default permissions and grant only what is required in each job.
permissions: {}

on:
  workflow_dispatch:
  pull_request:
  push:
    branches: [main, master]

env:
  GO_VERSION: '1.20'
  GOLINTERS_VERSION: 1.53.3
  GOLINTERS_ARCH: linux-amd64
  GOLINTERS_TGZ_DGST: 4f62007ca96372ccba54760e2ed39c2446b40ec24d9a90c21aad9f2fdf6cf0da
  GOLINTERS_TIMEOUT: 15m
  OPENSSL_DGST_CMD: openssl dgst -sha256 -r
  CURL_CMD: curl --proto =https --tlsv1.2 --location --silent --show-error --fail

jobs:
  main:
    name: Lint
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout source
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
        with:
          fetch-depth: 1

      - name: Setup Go
        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version: ${{ env.GO_VERSION }}
          check-latest: true

      - name: Install golangci-lint
        run: |
          GOLINTERS_URL_PREFIX="https://github.com/golangci/golangci-lint/releases/download/v${GOLINTERS_VERSION}/"
          GOLINTERS_TGZ="golangci-lint-${GOLINTERS_VERSION}-${GOLINTERS_ARCH}.tar.gz"
          GOLINTERS_EXPECTED_DGST="${GOLINTERS_TGZ_DGST} *${GOLINTERS_TGZ}"
          DGST_CMD="${OPENSSL_DGST_CMD} ${GOLINTERS_TGZ}"

          cd $(mktemp -d /tmp/golinters.XXXXX)
          ${CURL_CMD} "${GOLINTERS_URL_PREFIX}${GOLINTERS_TGZ}" --output ${GOLINTERS_TGZ}

          GOLINTERS_GOT_DGST=$(${DGST_CMD})
          if [ "${GOLINTERS_GOT_DGST}" != "${GOLINTERS_EXPECTED_DGST}" ]
          then
            echo "Digest of tarball is not equal to expected digest."
            echo "Expected digest: " "${GOLINTERS_EXPECTED_DGST}"
            echo "Got digest:      " "${GOLINTERS_GOT_DGST}"
            exit 1
          fi

          tar --no-same-owner -xzf "${GOLINTERS_TGZ}" --strip-components 1
          install golangci-lint $(go env GOPATH)/bin
        shell: bash

      # Run required linters enabled in .golangci.yml (or default linters if yml doesn't exist)     
      - name: Run golangci-lint
        run: $(go env GOPATH)/bin/golangci-lint run --timeout="${GOLINTERS_TIMEOUT}"
        shell: bash