mirror of
https://github.com/actions/runner-images.git
synced 2025-12-10 19:16:48 +00:00
Check outdated pins
This commit is contained in:
lawrencegripper
18
.github/workflows/check-pinned-versions.yml
vendored
Normal file
18
.github/workflows/check-pinned-versions.yml
vendored
Normal file
@@ -0,0 +1,18 @@
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
pull_request:
|
||||
schedule:
|
||||
- cron: '0 0 * * *' # Run at midnight UTC every day
|
||||
|
||||
jobs:
|
||||
validate-json:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v3
|
||||
|
||||
- name: Validate JSON Schema
|
||||
shell: pwsh
|
||||
run: ./helpers/CheckOutdatedVersionPinning.ps1
|
||||
@@ -1,6 +1,9 @@
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
# A JSON schema validator which supports outputting line numbers for errors
|
||||
# this allows us to put annotations on builds for errors in the JSON files
|
||||
# `Test-Json` built in cmdline doesn't. No existing cli tool supports this
|
||||
# that I could find either. See: https://github.com/lawrencegripper/gripdev-json-schema-validator
|
||||
Install-Module -Name GripDevJsonSchemaValidator -Force -Scope CurrentUser
|
||||
|
||||
# Find all toolset JSON files
|
||||
@@ -9,16 +12,19 @@ $schemaFilePath = "./schemas/toolset-schema.json"
|
||||
|
||||
$toolsetHasErrors = $false
|
||||
foreach ($file in $toolsetFiles) {
|
||||
Write-Host ""
|
||||
Write-Host "🔍 Validating $($file.FullName)" -ForegroundColor Cyan
|
||||
|
||||
$validationResult = Test-JsonSchema -SchemaPath $schemaFilePath -JsonPath $file.FullName
|
||||
$validationResult = Test-JsonSchema -SchemaPath $schemaFilePath -JsonPath $file.FullName -PrettyPrint $false
|
||||
|
||||
if ($validationResult.Valid) {
|
||||
Write-Host "✅ JSON is valid." -ForegroundColor Green
|
||||
} else {
|
||||
# File has been modified since the commit, enforce validation
|
||||
$toolsetHasErrors = $true
|
||||
Write-Host "`n❌ JSON validation failed!" -ForegroundColor Red
|
||||
Write-Host " Found the following errors:`n" -ForegroundColor Yellow
|
||||
|
||||
$validationResult.Errors | ForEach-Object {
|
||||
Write-Host $_.UserMessage
|
||||
if ($env:GITHUB_ACTIONS -eq 'true') {
|
||||
|
||||
81
helpers/CheckOutdatedVersionPinning.ps1
Normal file
81
helpers/CheckOutdatedVersionPinning.ps1
Normal file
@@ -0,0 +1,81 @@
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
# Find all toolset JSON files
|
||||
$toolsetFiles = Get-ChildItem -Recurse -Filter "toolset-*.json" | Where-Object { $_.Name -notlike "*schema.json" }
|
||||
|
||||
$expiringPins = @()
|
||||
$now = Get-Date
|
||||
$warningDays = 30 # Warn if expiring within 30 days
|
||||
|
||||
foreach ($file in $toolsetFiles) {
|
||||
Write-Host "Processing $($file.Name)"
|
||||
$content = Get-Content $file.FullName | ConvertFrom-Json
|
||||
|
||||
# Recursively search for pinnedDetails in the JSON
|
||||
function Search-PinnedDetails {
|
||||
param($obj, $path)
|
||||
|
||||
$foundPins = @()
|
||||
|
||||
if ($obj -is [System.Management.Automation.PSCustomObject]) {
|
||||
foreach ($prop in $obj.PSObject.Properties) {
|
||||
if ($prop.Name -eq "pinnedDetails") {
|
||||
Write-Host "Found pinned version at $path"
|
||||
$reviewAt = [DateTime]::Parse($prop.Value.'review-at')
|
||||
$daysUntilExpiry = ($reviewAt - $now).Days
|
||||
|
||||
if ($daysUntilExpiry -lt $warningDays) {
|
||||
Write-Host "Adding to expiringPins array"
|
||||
$foundPins += @{
|
||||
Path = $path
|
||||
File = $file.Name
|
||||
ReviewAt = $reviewAt
|
||||
DaysUntilExpiry = $daysUntilExpiry
|
||||
Reason = $prop.Value.reason
|
||||
Link = $prop.Value.link
|
||||
}
|
||||
}
|
||||
} else {
|
||||
$foundPins += Search-PinnedDetails -obj $prop.Value -path "$path.$($prop.Name)"
|
||||
}
|
||||
}
|
||||
} elseif ($obj -is [Array]) {
|
||||
for ($i = 0; $i -lt $obj.Count; $i++) {
|
||||
$foundPins += Search-PinnedDetails -obj $obj[$i] -path "$path[$i]"
|
||||
}
|
||||
}
|
||||
|
||||
return $foundPins
|
||||
}
|
||||
|
||||
$expiringPins += Search-PinnedDetails -obj $content -path $file.Name
|
||||
}
|
||||
|
||||
if ($expiringPins) {
|
||||
$issueBody = "# Version Pinning Review Required`n`n"
|
||||
$issueBody += "The following pinned versions need review:`n`n"
|
||||
|
||||
foreach ($pin in $expiringPins) {
|
||||
$status = if ($pin.DaysUntilExpiry -lt 0) { "EXPIRED" } else { "Expiring Soon" }
|
||||
$issueBody += "## $($status) - $($pin.Path)`n"
|
||||
$issueBody += "- **File**: $($pin.File)`n"
|
||||
$issueBody += "- **Review Date**: $($pin.ReviewAt.ToString('yyyy-MM-dd'))`n"
|
||||
$issueBody += "- **Days until expiry**: $($pin.DaysUntilExpiry)`n"
|
||||
$issueBody += "- **Reason**: $($pin.Reason)`n"
|
||||
$issueBody += "- **Original PR**: $($pin.Link)`n`n"
|
||||
}
|
||||
|
||||
if ($env:GITHUB_ACTIONS -eq 'true') {
|
||||
# In GitHub Actions, create an issue
|
||||
$issueBody | gh issue create --title "Version Pinning Review Found Expired Pinned Versions" --body -
|
||||
}
|
||||
|
||||
Write-Host "`nIssue Content:`n"
|
||||
Write-Host $issueBody
|
||||
}
|
||||
else {
|
||||
Write-Host "No expiring pins found."
|
||||
if ($env:GITHUB_ACTIONS -eq 'true') {
|
||||
"expired_pins=0" >> $env:GITHUB_OUTPUT
|
||||
}
|
||||
}
|
||||
@@ -1,69 +0,0 @@
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
function Get-PinnedDetailsRecursive($obj) {
|
||||
$pinnedDetails = @()
|
||||
|
||||
if ($obj -is [System.Management.Automation.PSCustomObject]) {
|
||||
if ($obj.PSObject.Properties.Name -contains "review-at") {
|
||||
$pinnedDetails += $obj
|
||||
}
|
||||
foreach ($prop in $obj.PSObject.Properties) {
|
||||
Get-PinnedDetailsRecursive $prop.Value
|
||||
}
|
||||
}
|
||||
elseif ($obj -is [Array]) {
|
||||
foreach ($item in $obj) {
|
||||
Get-PinnedDetailsRecursive $item
|
||||
}
|
||||
}
|
||||
|
||||
return $pinnedDetails
|
||||
}
|
||||
|
||||
Write-Host "Checking pinned details for overdue review dates"
|
||||
|
||||
# Find all toolset JSON files in the current directory and subdirectories
|
||||
$toolsetFiles = Get-ChildItem -Recurse -Filter "toolset-*.json"
|
||||
|
||||
foreach ($toolsetFile in $toolsetFiles) {
|
||||
Write-Host "Checking $toolsetFile"
|
||||
|
||||
# Skip schema file
|
||||
if ($toolsetFile.Name -like "*toolset-schema.json") {
|
||||
continue
|
||||
}
|
||||
|
||||
# Get all objects with 'review-at' property from the JSON file
|
||||
$jsonContent = Get-Content $toolsetFile.FullName | ConvertFrom-Json
|
||||
|
||||
$pinnedDetails = Get-PinnedDetailsRecursive $jsonContent | Where-Object { $_ -ne $null }
|
||||
|
||||
foreach ($pinnedDetail in $pinnedDetails) {
|
||||
$reviewDate = $pinnedDetail.'review-at'
|
||||
$reason = $pinnedDetail.reason
|
||||
|
||||
Write-Host "Info: Review date $reviewDate, reason $reason"
|
||||
|
||||
if (![string]::IsNullOrEmpty($reviewDate)) {
|
||||
$reviewDateTime = [DateTime]::Parse($reviewDate)
|
||||
$currentTime = Get-Date
|
||||
$sevenDaysAgo = $currentTime.AddDays(-7)
|
||||
|
||||
Write-Host "Info: Review date $reviewDate, current time $currentTime"
|
||||
|
||||
# Check if review date is in the past
|
||||
if ($reviewDateTime -lt $currentTime) {
|
||||
Write-Host "ERROR: Overdue review date: $reviewDate for tool in $($toolsetFile.Name)"
|
||||
Write-Host " Pinned for '$reason'"
|
||||
Write-Host ""
|
||||
}
|
||||
|
||||
# Check if review date is within the next 7 days
|
||||
if ($reviewDateTime -gt $sevenDaysAgo -and $reviewDateTime -le $currentTime) {
|
||||
Write-Host "WARNING: Review date is coming up within the next 7 days: $reviewDate for tool in $($toolsetFile.Name)"
|
||||
Write-Host " Pinned for '$reason'"
|
||||
Write-Host ""
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -377,10 +377,21 @@
|
||||
},
|
||||
"aliyunCli": {
|
||||
"version": "3.0.174",
|
||||
"sha256": "0c51028a7a32fc02c8de855f73e273556f957115eb5624565738f9b9f83a50ba"
|
||||
"sha256": "0c51028a7a32fc02c8de855f73e273556f957115eb5624565738f9b9f83a50ba",
|
||||
"pinnedDetails": {
|
||||
"link": "https://github.com/actions/runner-images-internal/pull/6702",
|
||||
"reason": "Meaningful reason must be added at next update.",
|
||||
"review-at": "2025-06-01",
|
||||
"type": "preexisting-pinned-version-without-reason"
|
||||
}
|
||||
},
|
||||
"ocCli": {
|
||||
"version": "4.15.19"
|
||||
"version": "4.15.19",
|
||||
"pinnedDetails": {
|
||||
"link": "https://github.com/actions/runner-images-internal/pull/6702",
|
||||
"reason": "Meaningful reason must be added at next update.",
|
||||
"review-at": "2025-06-01",
|
||||
"type": "preexisting-pinned-version-without-reason"
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -380,13 +380,25 @@
|
||||
},
|
||||
"postgresql": {
|
||||
"version": "14.12.1",
|
||||
"signature": "698BA51AA27CC31282AACA5055E4B9190BC6C0E9"
|
||||
"signature": "698BA51AA27CC31282AACA5055E4B9190BC6C0E9",
|
||||
"pinnedDetails": {
|
||||
"link": "https://github.com/actions/runner-images-internal/pull/6702",
|
||||
"reason": "Meaningful reason must be added at next update.",
|
||||
"review-at": "2025-06-01",
|
||||
"type": "preexisting-pinned-version-without-reason"
|
||||
}
|
||||
},
|
||||
"kotlin": {
|
||||
"version": "latest"
|
||||
},
|
||||
"openssl": {
|
||||
"version": "1.1.1"
|
||||
"version": "1.1.1",
|
||||
"pinnedDetails": {
|
||||
"link": "https://github.com/actions/runner-images-internal/pull/6702",
|
||||
"reason": "Meaningful reason must be added at next update.",
|
||||
"review-at": "2024-06-01",
|
||||
"type": "preexisting-pinned-version-without-reason"
|
||||
}
|
||||
},
|
||||
"pwsh": {
|
||||
"version": "7.4"
|
||||
|
||||
@@ -107,7 +107,13 @@
|
||||
},
|
||||
"mingw": {
|
||||
"version": "14.2.0",
|
||||
"runtime": "ucrt"
|
||||
"runtime": "ucrt",
|
||||
"pinnedDetails": {
|
||||
"link": "https://github.com/actions/runner-images-internal/pull/6702",
|
||||
"reason": "Meaningful reason must be added at next update.",
|
||||
"review-at": "2025-06-01",
|
||||
"type": "preexisting-pinned-version-without-reason"
|
||||
}
|
||||
},
|
||||
"MsysPackages": {
|
||||
"msys2": [],
|
||||
@@ -318,7 +324,13 @@
|
||||
"version": "latest"
|
||||
},
|
||||
"openssl": {
|
||||
"version": "3.4.0"
|
||||
"version": "3.4.0",
|
||||
"pinnedDetails": {
|
||||
"link": "https://github.com/actions/runner-images-internal/pull/6702",
|
||||
"reason": "Meaningful reason must be added at next update.",
|
||||
"review-at": "2025-06-01",
|
||||
"type": "preexisting-pinned-version-without-reason"
|
||||
}
|
||||
},
|
||||
"pwsh": {
|
||||
"version": "7.4"
|
||||
|
||||
Reference in New Issue
Block a user