gx 0.8.4

CLI to manage Github Actions dependencies
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140

use super::{Context, Diagnostic, Rule, RuleName};
use crate::config::Level;

/// unpinned rule: detects actions that use tag refs instead of SHA pins.
pub struct UnpinnedRule;

impl UnpinnedRule {
    /// Check a single action for the unpinned rule.
    ///
    /// An action is pinned when the `uses:` ref carries a commit SHA — either a
    /// bare `@<sha>` or a `@<sha> # vX.Y.Z` pin. The typed reference answers this
    /// directly: `pin_sha()` is `Some` for both pinned shapes and `None` for a
    /// bare tag/branch ref.
    pub fn check_action(action: &crate::domain::file::actions::Located) -> Option<Diagnostic> {
        if action.action.reference.pin_sha().is_some() {
            return None;
        }
        let msg = format!(
            "action {} uses tag reference {} instead of SHA pin",
            &action.action.id,
            action.action.reference.label()
        );
        Some(
            Diagnostic::new(RuleName::Unpinned, Level::Error, msg)
                .with_workflow(action.site.file.clone())
                .with_line(action.origin.line),
        )
    }
}

impl Rule for UnpinnedRule {
    fn name(&self) -> RuleName {
        RuleName::Unpinned
    }

    fn default_level(&self) -> Level {
        Level::Error
    }

    fn check(&self, ctx: &Context) -> Vec<Diagnostic> {
        ctx.workflows
            .iter()
            .filter_map(Self::check_action)
            .collect()
    }
}

#[cfg(test)]
#[expect(clippy::unwrap_used, reason = "tests use unwrap freely")]
mod tests {
    use super::{Level, Rule as _, RuleName, UnpinnedRule};
    use crate::domain::action::identity::{ActionId, CommitSha, Version};
    use crate::domain::action::uses_ref::ParsedRef;
    use crate::domain::file::actions::{Located, WorkflowAction};
    use crate::domain::file::site::{Id, JobId, Origin, Slot, StepIndex, WorkflowPath};

    const VALID_SHA: &str = "8e8c483db84b4bee98b60c0593521ed34d9990e8";

    fn located(version: &str, sha: Option<&str>) -> Located {
        located_at(version, sha, None)
    }

    /// Mirror `UsesRef::interpret`: `Some(sha)` → a `Pinned` pin; a bare 40-hex
    /// `version` → `Sha`; anything else → a plain `Ref`.
    fn located_at(version: &str, sha: Option<&str>, line: Option<u32>) -> Located {
        let reference = match sha {
            Some(sha_str) => ParsedRef::Pinned {
                sha: CommitSha::from(sha_str),
                comment: Version::from(version),
            },
            None if CommitSha::is_valid(version) => ParsedRef::Sha(CommitSha::from(version)),
            None => ParsedRef::Ref(Version::from(version)),
        };
        Located {
            action: WorkflowAction {
                id: ActionId::from("actions/checkout"),
                reference,
            },
            site: Id {
                file: WorkflowPath::new(".github/workflows/ci.yml"),
                slot: Slot::WorkflowStep {
                    job: JobId::from("build"),
                    step: StepIndex::from(0_u16),
                },
            },
            origin: Origin { line },
        }
    }

    #[test]
    fn unpinned_rule_has_correct_metadata() {
        let rule = UnpinnedRule;
        assert_eq!(rule.name(), RuleName::Unpinned);
        assert_eq!(rule.default_level(), Level::Error);
    }

    #[test]
    fn sha_pin_with_version_comment_is_not_flagged() {
        let action = located("v6.0.1", Some(VALID_SHA));
        assert!(UnpinnedRule::check_action(&action).is_none());
    }

    #[test]
    fn sha_pin_without_comment_is_not_flagged() {
        let action = located(VALID_SHA, None);
        assert!(UnpinnedRule::check_action(&action).is_none());
    }

    #[test]
    fn tag_reference_is_flagged() {
        let action = located("v4", None);
        assert!(UnpinnedRule::check_action(&action).is_some());
    }

    #[test]
    fn diagnostic_carries_source_line_when_known() {
        let action = located_at("v4", None, Some(12));
        let diag = UnpinnedRule::check_action(&action).unwrap();
        assert_eq!(diag.line, Some(12));
    }

    #[test]
    fn diagnostic_omits_line_when_unknown() {
        let action = located_at("v4", None, None);
        let diag = UnpinnedRule::check_action(&action).unwrap();
        assert_eq!(diag.line, None);
    }

    #[test]
    fn message_does_not_embed_workflow_path() {
        // The renderer prepends the location; the message must not repeat it.
        let action = located("v4", None);
        let diag = UnpinnedRule::check_action(&action).unwrap();
        assert!(
            !diag.message.contains(".github/workflows/ci.yml"),
            "message should not embed the workflow path: {}",
            diag.message
        );
    }
}