oxsecurity / megalinter

🦙 MegaLinter analyzes 50 languages, 22 formats, 21 tooling formats, excessive copy-pastes, spelling mistakes and security issues in your repository sources with a GitHub Action, other CI tools or locally.
https://megalinter.io
GNU Affero General Public License v3.0
1.91k stars 235 forks source link

GitHub Action only considers major version when pulling Docker image #509

Closed ottumm closed 3 years ago

ottumm commented 3 years ago

Describe the bug

Using the Mega-Linter GitHub Action, there is no way to completely specify a full version, because it always pulls the v4 tagged image. See https://github.com/nvuillam/mega-linter/blob/510ad37a0456a762eadec0d992aaabcaf4cbc615/flavors/python/action.yml#L8-L10

This is a problem because I need to be able to ensure that linters provide consistent behavior across runs.

I'm not sure if it's possible to know which git tag was used to refer to an action from within the action (I suspect it's not), but if not then perhaps a version parameter could be added to the action so that the correct tag could be pulled. I'm happy to open a pull request with that solution if it sounds good.

To Reproduce

Use the following in a .github/workflows yaml:

name: tests
on:
  push:
    branches-ignore: [master]

jobs:
  lint:
    runs-on: [ubuntu-20.04]
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v2
        with:
          persist-credentials: false
      - name: mega-lint
        uses: nvuillam/mega-linter@v4.3.4
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Expected behavior

I expected this action to pull the Docker image with tag v4.34.0, but instead it pulls tag v4, which is a different image.

nvuillam commented 3 years ago

You're totally right... I knew this day would come ^^

Until I find a way to make match the Github action version with the Docker image version, you can use npx mega-linter-runner as workaround

npx mega-linter-runner --release v4.34.0

As you need node/npm, you may need to call the node setup action before

- uses: actions/setup-node@v1
  with: 
     node-version: "12.x"
     registry-url: "https://registry.npmjs.org"
ottumm commented 3 years ago

Would it be possible to include the full Docker version tag within the action.yaml files and auto-update it every time you cut a release?

nvuillam commented 3 years ago

Half of the repo is auto-generated so yes, that's the plan :) But i'm missing time for the PR (because of my job that pays my rent)... so i can plan to do it next week-end, except if you or someone else is in the mood for a PR ? :)

ottumm commented 3 years ago

But i'm missing time for the PR (because of my job that pays my rent)

Of course of course! Rent (unfortunately) must be paid.

so i can plan to do it next week-end, except if you or someone else is in the mood for a PR ? :)

I'll see if I have time this week to put something together.

I had an idea about using a VERSION file with the full version string in it (maybe that already exists) and then using a github action step that reads that file and outputs the string, which then can be used as a parameter via the steps context. That way the yaml files wouldn't actually need to be auto-generated, they could read the full version dynamically at run-time (if this works). Does that seem like a reasonable approach to at least investigate?

nvuillam commented 3 years ago

I'm not sure we can dynamically build image tag in action.yml files used by Github Actions

image

But what we can do is update action.yml files (main one + action.yml in flavors folder) with a script :)

We could do something like a script release.py -v v4.x.x This would perform the following commands (syntax not exact ^^):

I would call this script everytime before releasing a new version, then we're all good :)

nvuillam commented 3 years ago

@ottumm I made the change and released it with v4.38.0 :) Now the mega-linter docker version will always be matching the github action version :)

ottumm commented 3 years ago

Hero!!! Thank you!

nvuillam commented 3 years ago

You're welcome ;)