feat(wfctl): validate rendered CI provider artifacts#866
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR strengthens wfctl’s CI generation/validation workflow by adding offline validation of rendered CI provider artifacts (GitHub Actions, GitLab CI, Jenkins, CircleCI), and standardizes generated/scaffolded GitHub Actions workflows on actions/checkout@v6.
Changes:
- Added
cigen.ValidateRenderedFileswith GitHub Actions validation backed by embeddedgithub.com/rhysd/actionlint(no external shellcheck/pyflakes). - Wired
wfctl ci generateto validate rendered provider artifacts before writing, and addedwfctl ci validate --platformfor validating existing rendered artifacts. - Updated templates/docs/workflows to emit/use
actions/checkout@v6and refreshed related tests.
Reviewed changes
Copilot reviewed 40 out of 41 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| plugin/sdk/generator.go | Update generated plugin CI/release workflows to actions/checkout@v6. |
| mcp/wfctl_tools.go | Update scaffolded CD workflow snippets to actions/checkout@v6. |
| mcp/scaffold_tools.go | Update GitHub Actions bootstrap scaffold to actions/checkout@v6. |
| mcp/scaffold_tools_test.go | Adjust scaffold test expectations for actions/checkout@v6. |
| go.mod | Add direct dependency on github.com/rhysd/actionlint v1.7.12. |
| go.sum | Record checksums for actionlint and new indirect dependencies. |
| docs/WFCTL.md | Document generated-artifact validation and new wfctl ci validate --platform usage; bump checkout references. |
| docs/tutorials/deploy-pipeline.md | Bump tutorial workflow examples to actions/checkout@v6. |
| docs/PLUGIN_RELEASE_GATES.md | Bump example workflow to actions/checkout@v6. |
| docs/manual/build-deploy/03-ci-deploy-environments.md | Bump documented workflow snippets to actions/checkout@v6. |
| data/registry/.github/workflows/validate.yml | Bump checkout in registry validation workflows to actions/checkout@v6. |
| cmd/wfctl/templates/ui-plugin/.github/workflows/release.yml.tmpl | Bump template checkout to actions/checkout@v6. |
| cmd/wfctl/templates/plugin/.github/workflows/release.yml.tmpl | Bump template checkout to actions/checkout@v6. |
| cmd/wfctl/templates/full-stack/.github/workflows/ci.yml.tmpl | Bump template checkout to actions/checkout@v6. |
| cmd/wfctl/templates/event-processor/.github/workflows/ci.yml.tmpl | Bump template checkout to actions/checkout@v6. |
| cmd/wfctl/templates/api-service/.github/workflows/ci.yml.tmpl | Bump template checkout to actions/checkout@v6. |
| cmd/wfctl/generate.go | Bump generated workflow snippets to actions/checkout@v6. |
| cmd/wfctl/generate_test.go | Update generator tests to expect actions/checkout@v6. |
| cmd/wfctl/ci.go | Validate rendered CI artifacts during wfctl ci generate before writing. |
| cmd/wfctl/ci_validate.go | Add --platform mode to validate rendered provider artifacts using cigen.ValidateRenderedFiles. |
| cmd/wfctl/ci_validate_artifacts_test.go | Add test ensuring invalid GitHub Actions artifacts fail in --platform mode. |
| cmd/wfctl/ci_test.go | Update CI generation tests to expect actions/checkout@v6. |
| cmd/wfctl/ci_init.go | Bump bootstrap workflow generation to actions/checkout@v6. |
| cigen/validate.go | New rendered-artifact validation (actionlint for GHA; offline structural checks for others). |
| cigen/validate_test.go | New tests for rendered-artifact validation across platforms and actionlint usage. |
| cigen/testdata/multisite/generated-infra.yml | Update testdata to actions/checkout@v6. |
| cigen/render_gha.go | Bump rendered GHA checkout step to actions/checkout@v6. |
| .github/workflows/release.yml | Bump repo release workflow checkout to actions/checkout@v6. |
| .github/workflows/pre-release.yml | Bump repo pre-release workflow checkout to actions/checkout@v6. |
| .github/workflows/helm-lint.yml | Bump checkout to actions/checkout@v6. |
| .github/workflows/dependency-update.yml | Bump checkout to actions/checkout@v6. |
| .github/workflows/cross-plugin-build-test.yml | Bump checkout steps to actions/checkout@v6. |
| .github/workflows/create-release.yml | Bump checkout to actions/checkout@v6. |
| .github/workflows/copilot-setup-steps.yml | Bump checkout to actions/checkout@v6. |
| .github/workflows/conformance-smoke.yml | Bump checkout to actions/checkout@v6. |
| .github/workflows/conformance-leak-scrubber.yml | Bump checkout to actions/checkout@v6. |
| .github/workflows/conformance-budget-check.yml | Bump checkout to actions/checkout@v6. |
| .github/workflows/codeql.yml | Bump checkout to actions/checkout@v6. |
| .github/workflows/ci.yml | Bump checkout across CI jobs to actions/checkout@v6. |
| .github/workflows/ci-wfctl.yml.example | Bump example workflow checkout references to actions/checkout@v6. |
| .github/workflows/benchmark.yml | Bump checkout to actions/checkout@v6. |
Comment on lines
+131
to
+149
| rendered := make(map[string]string, len(files)) | ||
| for _, file := range files { | ||
| data, err := os.ReadFile(file) | ||
| if err != nil { | ||
| rendered[file] = "" | ||
| continue | ||
| } | ||
| rendered[file] = string(data) | ||
| } | ||
| findings := cigen.ValidateRenderedFiles(platform, rendered) | ||
| for _, file := range files { | ||
| if _, err := os.Stat(file); err != nil { | ||
| findings = append(findings, cigen.ValidationFinding{ | ||
| Path: file, | ||
| Code: "read_ci_artifact", | ||
| Message: fmt.Sprintf("read CI artifact: %v", err), | ||
| }) | ||
| } | ||
| } |
Comment on lines
+166
to
+168
| if !passed { | ||
| return fmt.Errorf("%d file(s) failed ci validate", len(files)) | ||
| } |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cigen.ValidateRenderedFilesfor rendered GitHub Actions, GitLab CI, Jenkins, and CircleCI artifacts.wfctl ci generateto validate rendered files before writing and addwfctl ci validate --platformfor provider artifacts.github.com/rhysd/actionlintdependency for GitHub Actions validation; externalshellcheck/pyflakesintegrations are disabled.actions/checkoutreferences emitted by generators/templates/workflows to the current@v6major tag.Version checks
github.com/rhysd/actionlintlatest release isv1.7.12; added that Go dependency directly.actions/checkoutlatest release isv6.0.2; generated references use the stable@v6tag.Verification
GOWORK=off go test ./cigen -run 'TestValidateRenderedFiles|TestRenderGitHubActions' -count=1GOWORK=off go test ./cmd/wfctl -run 'TestRunCIValidate|TestCIGenerate|TestGenerateGitHubActions|TestGenerateGitLabCI|TestWriteCIWorkflow' -count=1GOWORK=off go test ./cigen ./cmd/wfctl ./mcp ./plugin/sdk -count=1git diff --checkFixes #863