diff --git a/.github/workflows/check-pinned-versions.yml b/.github/workflows/check-pinned-versions.yml new file mode 100644 index 000000000..da8adc314 --- /dev/null +++ b/.github/workflows/check-pinned-versions.yml @@ -0,0 +1,18 @@ +on: + push: + branches: + - main + pull_request: + schedule: + - cron: '0 0 * * *' # Run at midnight UTC every day + +jobs: + validate-json: + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + - name: Validate JSON Schema + shell: pwsh + run: ./helpers/CheckOutdatedVersionPinning.ps1 diff --git a/helpers/CheckJsonSchema.ps1 b/helpers/CheckJsonSchema.ps1 index e338530d4..4155fb899 100644 --- a/helpers/CheckJsonSchema.ps1 +++ b/helpers/CheckJsonSchema.ps1 @@ -1,7 +1,10 @@ $ErrorActionPreference = 'Stop' # A JSON schema validator which supports outputting line numbers for errors -Install-Module -Name GripDevJsonSchemaValidator -Force -Scope CurrentUser +# this allows us to put annotations on builds for errors in the JSON files +# `Test-Json` built in cmdline doesn't. No existing cli tool supports this +# that I could find either. See: https://github.com/lawrencegripper/gripdev-json-schema-validator +Install-Module -Name GripDevJsonSchemaValidator -Force -Scope CurrentUser # Find all toolset JSON files $toolsetFiles = Get-ChildItem -Recurse -Filter "toolset-*.json" | Where-Object { $_.Name -notlike "*schema.json" } @@ -9,16 +12,19 @@ $schemaFilePath = "./schemas/toolset-schema.json" $toolsetHasErrors = $false foreach ($file in $toolsetFiles) { + Write-Host "" Write-Host "šŸ” Validating $($file.FullName)" -ForegroundColor Cyan - $validationResult = Test-JsonSchema -SchemaPath $schemaFilePath -JsonPath $file.FullName + $validationResult = Test-JsonSchema -SchemaPath $schemaFilePath -JsonPath $file.FullName -PrettyPrint $false if ($validationResult.Valid) { Write-Host "āœ… JSON is valid." -ForegroundColor Green } else { + # File has been modified since the commit, enforce validation $toolsetHasErrors = $true Write-Host "`nāŒ JSON validation failed!" -ForegroundColor Red Write-Host " Found the following errors:`n" -ForegroundColor Yellow + $validationResult.Errors | ForEach-Object { Write-Host $_.UserMessage if ($env:GITHUB_ACTIONS -eq 'true') { diff --git a/helpers/CheckOutdatedVersionPinning.ps1 b/helpers/CheckOutdatedVersionPinning.ps1 new file mode 100644 index 000000000..10a4e26de --- /dev/null +++ b/helpers/CheckOutdatedVersionPinning.ps1 @@ -0,0 +1,81 @@ +$ErrorActionPreference = 'Stop' + +# Find all toolset JSON files +$toolsetFiles = Get-ChildItem -Recurse -Filter "toolset-*.json" | Where-Object { $_.Name -notlike "*schema.json" } + +$expiringPins = @() +$now = Get-Date +$warningDays = 30 # Warn if expiring within 30 days + +foreach ($file in $toolsetFiles) { + Write-Host "Processing $($file.Name)" + $content = Get-Content $file.FullName | ConvertFrom-Json + + # Recursively search for pinnedDetails in the JSON + function Search-PinnedDetails { + param($obj, $path) + + $foundPins = @() + + if ($obj -is [System.Management.Automation.PSCustomObject]) { + foreach ($prop in $obj.PSObject.Properties) { + if ($prop.Name -eq "pinnedDetails") { + Write-Host "Found pinned version at $path" + $reviewAt = [DateTime]::Parse($prop.Value.'review-at') + $daysUntilExpiry = ($reviewAt - $now).Days + + if ($daysUntilExpiry -lt $warningDays) { + Write-Host "Adding to expiringPins array" + $foundPins += @{ + Path = $path + File = $file.Name + ReviewAt = $reviewAt + DaysUntilExpiry = $daysUntilExpiry + Reason = $prop.Value.reason + Link = $prop.Value.link + } + } + } else { + $foundPins += Search-PinnedDetails -obj $prop.Value -path "$path.$($prop.Name)" + } + } + } elseif ($obj -is [Array]) { + for ($i = 0; $i -lt $obj.Count; $i++) { + $foundPins += Search-PinnedDetails -obj $obj[$i] -path "$path[$i]" + } + } + + return $foundPins + } + + $expiringPins += Search-PinnedDetails -obj $content -path $file.Name +} + +if ($expiringPins) { + $issueBody = "# Version Pinning Review Required`n`n" + $issueBody += "The following pinned versions need review:`n`n" + + foreach ($pin in $expiringPins) { + $status = if ($pin.DaysUntilExpiry -lt 0) { "EXPIRED" } else { "Expiring Soon" } + $issueBody += "## $($status) - $($pin.Path)`n" + $issueBody += "- **File**: $($pin.File)`n" + $issueBody += "- **Review Date**: $($pin.ReviewAt.ToString('yyyy-MM-dd'))`n" + $issueBody += "- **Days until expiry**: $($pin.DaysUntilExpiry)`n" + $issueBody += "- **Reason**: $($pin.Reason)`n" + $issueBody += "- **Original PR**: $($pin.Link)`n`n" + } + + if ($env:GITHUB_ACTIONS -eq 'true') { + # In GitHub Actions, create an issue + $issueBody | gh issue create --title "Version Pinning Review Found Expired Pinned Versions" --body - + } + + Write-Host "`nIssue Content:`n" + Write-Host $issueBody +} +else { + Write-Host "No expiring pins found." + if ($env:GITHUB_ACTIONS -eq 'true') { + "expired_pins=0" >> $env:GITHUB_OUTPUT + } +} diff --git a/helpers/CheckPinnedDetails.ps1 b/helpers/CheckPinnedDetails.ps1 deleted file mode 100755 index 03b573e6a..000000000 --- a/helpers/CheckPinnedDetails.ps1 +++ /dev/null @@ -1,69 +0,0 @@ -$ErrorActionPreference = 'Stop' - -function Get-PinnedDetailsRecursive($obj) { - $pinnedDetails = @() - - if ($obj -is [System.Management.Automation.PSCustomObject]) { - if ($obj.PSObject.Properties.Name -contains "review-at") { - $pinnedDetails += $obj - } - foreach ($prop in $obj.PSObject.Properties) { - Get-PinnedDetailsRecursive $prop.Value - } - } - elseif ($obj -is [Array]) { - foreach ($item in $obj) { - Get-PinnedDetailsRecursive $item - } - } - - return $pinnedDetails -} - -Write-Host "Checking pinned details for overdue review dates" - -# Find all toolset JSON files in the current directory and subdirectories -$toolsetFiles = Get-ChildItem -Recurse -Filter "toolset-*.json" - -foreach ($toolsetFile in $toolsetFiles) { - Write-Host "Checking $toolsetFile" - - # Skip schema file - if ($toolsetFile.Name -like "*toolset-schema.json") { - continue - } - - # Get all objects with 'review-at' property from the JSON file - $jsonContent = Get-Content $toolsetFile.FullName | ConvertFrom-Json - - $pinnedDetails = Get-PinnedDetailsRecursive $jsonContent | Where-Object { $_ -ne $null } - - foreach ($pinnedDetail in $pinnedDetails) { - $reviewDate = $pinnedDetail.'review-at' - $reason = $pinnedDetail.reason - - Write-Host "Info: Review date $reviewDate, reason $reason" - - if (![string]::IsNullOrEmpty($reviewDate)) { - $reviewDateTime = [DateTime]::Parse($reviewDate) - $currentTime = Get-Date - $sevenDaysAgo = $currentTime.AddDays(-7) - - Write-Host "Info: Review date $reviewDate, current time $currentTime" - - # Check if review date is in the past - if ($reviewDateTime -lt $currentTime) { - Write-Host "ERROR: Overdue review date: $reviewDate for tool in $($toolsetFile.Name)" - Write-Host " Pinned for '$reason'" - Write-Host "" - } - - # Check if review date is within the next 7 days - if ($reviewDateTime -gt $sevenDaysAgo -and $reviewDateTime -le $currentTime) { - Write-Host "WARNING: Review date is coming up within the next 7 days: $reviewDate for tool in $($toolsetFile.Name)" - Write-Host " Pinned for '$reason'" - Write-Host "" - } - } - } -} diff --git a/images/ubuntu/toolsets/toolset-2004.json b/images/ubuntu/toolsets/toolset-2004.json index e96d97b2b..07885f4aa 100644 --- a/images/ubuntu/toolsets/toolset-2004.json +++ b/images/ubuntu/toolsets/toolset-2004.json @@ -377,10 +377,21 @@ }, "aliyunCli": { "version": "3.0.174", - "sha256": "0c51028a7a32fc02c8de855f73e273556f957115eb5624565738f9b9f83a50ba" + "sha256": "0c51028a7a32fc02c8de855f73e273556f957115eb5624565738f9b9f83a50ba", + "pinnedDetails": { + "link": "https://github.com/actions/runner-images-internal/pull/6702", + "reason": "Meaningful reason must be added at next update.", + "review-at": "2025-06-01", + "type": "preexisting-pinned-version-without-reason" + } }, "ocCli": { - "version": "4.15.19" - } - + "version": "4.15.19", + "pinnedDetails": { + "link": "https://github.com/actions/runner-images-internal/pull/6702", + "reason": "Meaningful reason must be added at next update.", + "review-at": "2025-06-01", + "type": "preexisting-pinned-version-without-reason" + } + } } diff --git a/images/windows/toolsets/toolset-2022.json b/images/windows/toolsets/toolset-2022.json index 280820b87..8f2b34269 100644 --- a/images/windows/toolsets/toolset-2022.json +++ b/images/windows/toolsets/toolset-2022.json @@ -380,13 +380,25 @@ }, "postgresql": { "version": "14.12.1", - "signature": "698BA51AA27CC31282AACA5055E4B9190BC6C0E9" + "signature": "698BA51AA27CC31282AACA5055E4B9190BC6C0E9", + "pinnedDetails": { + "link": "https://github.com/actions/runner-images-internal/pull/6702", + "reason": "Meaningful reason must be added at next update.", + "review-at": "2025-06-01", + "type": "preexisting-pinned-version-without-reason" + } }, "kotlin": { "version": "latest" }, "openssl": { - "version": "1.1.1" + "version": "1.1.1", + "pinnedDetails": { + "link": "https://github.com/actions/runner-images-internal/pull/6702", + "reason": "Meaningful reason must be added at next update.", + "review-at": "2024-06-01", + "type": "preexisting-pinned-version-without-reason" + } }, "pwsh": { "version": "7.4" diff --git a/images/windows/toolsets/toolset-2025.json b/images/windows/toolsets/toolset-2025.json index e886e1115..2a413f891 100644 --- a/images/windows/toolsets/toolset-2025.json +++ b/images/windows/toolsets/toolset-2025.json @@ -107,7 +107,13 @@ }, "mingw": { "version": "14.2.0", - "runtime": "ucrt" + "runtime": "ucrt", + "pinnedDetails": { + "link": "https://github.com/actions/runner-images-internal/pull/6702", + "reason": "Meaningful reason must be added at next update.", + "review-at": "2025-06-01", + "type": "preexisting-pinned-version-without-reason" + } }, "MsysPackages": { "msys2": [], @@ -318,7 +324,13 @@ "version": "latest" }, "openssl": { - "version": "3.4.0" + "version": "3.4.0", + "pinnedDetails": { + "link": "https://github.com/actions/runner-images-internal/pull/6702", + "reason": "Meaningful reason must be added at next update.", + "review-at": "2025-06-01", + "type": "preexisting-pinned-version-without-reason" + } }, "pwsh": { "version": "7.4"