From 4ada364edec9eb38665dcc34f7111c5435e2306c Mon Sep 17 00:00:00 2001
From: Casey Rodarmor <casey@rodarmor.com>
Date: Mon, 26 Jul 2021 17:14:20 -0700
Subject: [PATCH] Check GitHub Actions workflow with actionlint (#921)

---
 .github/workflows/build.yaml | 49 +++++++++++++++++++++++-------------
 justfile                     |  8 ++++--
 2 files changed, 37 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index e410b3a..4ed8340 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -47,13 +47,22 @@ jobs:
     steps:
     - uses: actions/checkout@v2
 
+    - name: Download actionlint
+      id: actionlint
+      run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+
+    - name: Check Github Actions Workflow
+      env:
+        SHELLCHECK_OPTS: "-e SC2006 -e SC2002 -e SC2050"
+      run: ${{ steps.actionlint.outputs.executable }} -color
+
     # An issue with BSD Tar causes sporadic failures on macOS.
     # c.f https://github.com/actions/cache/issues/403
     - name: Install GNU Tar
-      if: matrix.os == 'macos-latest'
+      if: ${{ matrix.os == 'macos-latest' }}
       run: |
         brew install gnu-tar
-        echo /usr/local/opt/gnu-tar/libexec/gnubin > $GITHUB_PATH
+        echo /usr/local/opt/gnu-tar/libexec/gnubin > "$GITHUB_PATH"
 
     - name: Cache Cargo
       uses: actions/cache@v2
@@ -62,10 +71,10 @@ jobs:
           ~/.cargo/registry
           ~/.cargo/git
           target
-        key: ${{ matrix.configration.os }}-${{ matrix.target }} cargo-${{ hashFiles('**/Cargo.lock') }}
+        key: ${{ matrix.os }}-${{ matrix.target }} cargo-${{ hashFiles('**/Cargo.lock') }}
 
     - name: Update Ubuntu Packages
-      if: matrix.os == 'ubuntu-latest'
+      if: ${{ matrix.os == 'ubuntu-latest' }}
       run: |
         sudo apt-get update
 
@@ -73,10 +82,10 @@ jobs:
       run: |
         rustup component add clippy
         rustup target add ${{ matrix.target }}
-        rustup default `cat rust-toolchain`-${{ matrix.target }}
+        rustup default "`cat rust-toolchain`-${{ matrix.target }}"
 
     - name: Install AArch64 Toolchain
-      if: matrix.target == 'aarch64-unknown-linux-gnu'
+      if: ${{ matrix.target == 'aarch64-unknown-linux-gnu' }}
       run: sudo apt-get install gcc-aarch64-linux-gnu
 
     - name: Info
@@ -93,7 +102,7 @@ jobs:
       run: cargo build --all --target ${{ matrix.target }}
 
     - name: Test
-      if: matrix.native
+      if: ${{ matrix.native }}
       run: cargo test --all --target ${{ matrix.target }}
 
     - name: Clippy
@@ -111,13 +120,13 @@ jobs:
       run: cargo +nightly fmt --all -- --check
 
     - name: Completion Scripts
-      if: matrix.os != 'windows-2016'
+      if: ${{ matrix.os != 'windows-2016' }}
       run: |
         ./bin/generate-completions
         git diff --no-ext-diff --quiet --exit-code
 
     - name: Check for Forbidden Words
-      if: matrix.os == 'ubuntu-latest'
+      if: ${{ matrix.os == 'ubuntu-latest' }}
       run: |
         sudo apt-get update
         sudo apt-get install ripgrep
@@ -128,30 +137,30 @@ jobs:
       run: cargo run --package ref-type -- --reference ${{ github.ref }}
 
     - name: Test Install Script With Explicit Target
-      if: matrix.os != 'windows-2016' && steps.ref-type.outputs.value != 'release'
+      if: ${{ matrix.os != 'windows-2016' && steps.ref-type.outputs.value != 'release' }}
       run: |
-        cd `mktemp -d`
-        cat $GITHUB_WORKSPACE/docs/install.sh | bash -s -- --target ${{ matrix.target }} --to .
+        cd "`mktemp -d`"
+        cat "$GITHUB_WORKSPACE/docs/install.sh" | bash -s -- --target ${{ matrix.target }} --to .
         if [[ ${{ matrix.native }} == true ]]; then
           ./just --version
         fi
 
     - name: Test Install Script Without Explicit Target
-      if: matrix.os != 'windows-2016' && steps.ref-type.outputs.value != 'release'
+      if: ${{ matrix.os != 'windows-2016' && steps.ref-type.outputs.value != 'release' }}
       run: |
-        cd `mktemp -d`
-        cat $GITHUB_WORKSPACE/docs/install.sh | bash -s -- --to .
+        cd "`mktemp -d`"
+        cat "$GITHUB_WORKSPACE/docs/install.sh" | bash -s -- --to .
         ./just --version
 
     - name: Package
       id: package
-      if: startsWith(github.ref, 'refs/tags/')
+      if: ${{ startsWith(github.ref, 'refs/tags/') }}
       run: ./bin/package ${{github.ref}} ${{matrix.os}} ${{ matrix.target }}
       shell: bash
 
     - name: Publish Archive
       uses: softprops/action-gh-release@v0.1.5
-      if: startsWith(github.ref, 'refs/tags/')
+      if: ${{ startsWith(github.ref, 'refs/tags/') }}
       with:
         draft: false
         files: ${{ steps.package.outputs.archive }}
@@ -161,7 +170,11 @@ jobs:
 
     - name: Publish Changelog
       uses: softprops/action-gh-release@v0.1.5
-      if: startsWith(github.ref, 'refs/tags/') && matrix.target == 'x86_64-unknown-linux-musl'
+      if: >-
+        ${{
+          startsWith(github.ref, 'refs/tags/')
+          && matrix.target == 'x86_64-unknown-linux-musl'
+        }}
       with:
         draft: false
         files: CHANGELOG.md
diff --git a/justfile b/justfile
index 1359d2f..01faa9a 100755
--- a/justfile
+++ b/justfile
@@ -61,7 +61,7 @@ version := `sed -En 's/version[[:space:]]*=[[:space:]]*"([^"]+)"/\1/p' Cargo.tom
 changes:
   git log --pretty=format:%s >> CHANGELOG.md
 
-check: clippy fmt test forbid
+check: actionlint fmt clippy test forbid
   git diff --no-ext-diff --quiet --exit-code
   grep '^\[{{ version }}\]' CHANGELOG.md
   cargo +nightly generate-lockfile -Z minimal-versions
@@ -108,7 +108,11 @@ install-dev-deps:
 
 # install system development dependencies with homebrew
 install-dev-deps-homebrew:
-  brew install help2man
+  brew tap "rhysd/actionlint" "https://github.com/rhysd/actionlint"
+  brew install actionlint help2man shellcheck
+
+actionlint:
+  SHELLCHECK_OPTS='-e SC2006 -e SC2002 -e SC2050' actionlint
 
 # everyone's favorite animate paper clip
 clippy: