mpalmer / action-validator

Tool to validate GitHub Action and Workflow YAML files
GNU General Public License v3.0
271 stars 25 forks source link

YAML references aren't supported, but aren't caught by action-validator #70

Open sourcefrog opened 5 months ago

sourcefrog commented 5 months ago

In https://github.com/sourcefrog/cargo-mutants/pull/268/commits/b7cdf0732b5883246c2e169e3cee99468621cb7a I tried using YAML references to reduce duplication:

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index eaafc66..1169d22 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -4,11 +4,8 @@ permissions:
   contents: read

 on:
-  push:
-    branches:
-      - main
   pull_request:
-    paths:
+    paths: &test_affecting_paths
       - ".cargo/*.toml"
       - ".github/workflows/tests.yml"
       - "Cargo.*"
@@ -16,6 +13,10 @@ on:
       - "src/**"
       - "testdata/**"
       - "tests/**"
+  push:
+    branches:
+      - main
+    paths: *test_affecting_paths

 # see https://matklad.github.io/2021/09/04/fast-rust-builds.html
 env:

GitHub rejects this with

Invalid workflow file: .github/workflows/tests.yml#L1 The workflow is not valid. .github/workflows/tests.yml: Anchors are not currently supported. Remove the anchor 'test_affecting_paths'

but action-validator says nothing about it.

mpalmer commented 5 months ago

GitHub's half-baked YAML parser strikes again...

Given how much of a basic feature YAML anchors/references are, there's no way to tell the Rust YAML parser to not support them (per #7). Thus, the only way to implement this would be to either do a quick pre-check of the file for "things that look like anchors/references" (which seems prone to false-positives), or else write a custom YAML parser that more closely imitated GitHub's broken implementation (which is rather a lot of work). Adding another :+1: to the actions/runner issue for anchors support probably won't help anything, but it's unlikely to make the issue any worse...

As this is the second time this has come up, I'll leave this issue open with a pr-welcome tag, just in case someone gets a rush of blood to the head, but it's too big a chunk of work for me to take on at the moment.