Repository: stackrox/stackrox
Pull request #14922: chore: Move jobs from `lint.yml` to `style.yml`
Author: login: msugakov
Labels: name: area/ci
Created: 2025-04-08T17:26:09Z | Merged: 2025-04-10T08:18:35Z

### Description

While looking into https://github.com/stackrox/stackrox/pull/14827, I felt that I don't understand the reason why `lint.yml` is separate from `style.yml` and so in this PR I unify the two.

Unfortunately, the line history in `lint.yml` will likely be lost so here I reference its version before I touched it: https://github.com/stackrox/stackrox/blob/8dcfbe3cf20bf7b8730121db97663bd83a091156/.github/workflows/lint.yml

### User-facing documentation

- [x] CHANGELOG is updated **OR** update is not needed
- [x] [documentation PR](https://spaces.redhat.com/display/StackRox/Submitting+a+User+Documentation+Pull+Request) is created and is linked above **OR** is not needed

### Testing and quality

<!--
General Availability requirements: https://github.com/stackrox/stackrox/blob/master/PR_GA.md
Feature Flags usage: https://github.com/stackrox/stackrox/blob/master/pkg/features/README.md
-->

- [x] the change is production ready: the change is GA or otherwise the functionality is gated by a feature flag
- [x] CI results are inspected

#### Automated testing

No change.

#### How I validated my change

Looked into CI output.

## Summary by Sourcery

Consolidate GitHub Actions workflow jobs from `lint.yml` into `style.yml`

CI:
- Move GitHub Actions linting jobs including actionlint, shellcheck, and OpenShift CI linting from a separate workflow file to the existing style workflow

Chores:
- Remove the standalone `lint.yml` workflow file and integrate its jobs into `style.yml`


Diff:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
deleted file mode 100644
index 126dcd27113c5..0000000000000
--- a/.github/workflows/lint.yml
+++ /dev/null
@@ -1,51 +0,0 @@
-name: Lint
-on:
-  push:
-    tags:
-    - '*'
-    branches:
-    - master
-    - release-*
-  pull_request:
-    types:
-    - opened
-    - reopened
-    - synchronize
-
-jobs:
-  github-actions-lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Download actionlint
-        id: get_actionlint
-        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.6.27
-        shell: bash
-      - name: Check workflow files
-        run: ${{ steps.get_actionlint.outputs.executable }} -color
-        shell: bash
-
-  github-actions-shellcheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check scripts with shellcheck
-        run: shellcheck -P SCRIPTDIR -x ./.github/workflows/scripts/*.sh
-
-  openshift-ci-lint:
-    runs-on: ubuntu-latest
-    container:
-      image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.4.8
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - uses: ./.github/actions/job-preamble
-        with:
-          gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
-
-      - name: Pylint
-        run: make -C .openshift-ci lint
diff --git a/.github/workflows/style.yaml b/.github/workflows/style.yaml
index d5c166168334a..bb422118f8547 100644
--- a/.github/workflows/style.yaml
+++ b/.github/workflows/style.yaml
@@ -197,6 +197,43 @@ jobs:
           image: rhacs-eng/${{ matrix.image }}:${{ steps.image-tag.outputs.image-tag }}-fast
           limit: 300
 
+  github-actions-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Download actionlint
+        id: get_actionlint
+        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/2ab3a12c7848f6c15faca9a92612ef4261d0e370/scripts/download-actionlint.bash) 1.6.27
+        shell: bash
+      - name: Check workflow files
+        run: ${{ steps.get_actionlint.outputs.executable }} -color
+        shell: bash
+
+  github-actions-shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check scripts with shellcheck
+        run: shellcheck -P SCRIPTDIR -x ./.github/workflows/scripts/*.sh
+
+  openshift-ci-lint:
+    runs-on: ubuntu-latest
+    container:
+      image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.4.8
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - uses: ./.github/actions/job-preamble
+        with:
+          gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
+
+      - name: Pylint
+        run: make -C .openshift-ci lint
+
   slack-on-style-failure:
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -215,6 +252,9 @@ jobs:
       - style-check
       - golangci-lint
       - check-collector-and-scanner-images-exist
+      - github-actions-lint
+      - github-actions-shellcheck
+      - openshift-ci-lint
     permissions:
       actions: read
     steps:


Reviews:
user: login: sourcery-ai[bot]
body: Hey @msugakov - I've reviewed your changes - here's some feedback:

**Overall Comments**:
- Consider whether the jobs being moved should be reordered in the destination file.

<details>
<summary>Here's what I looked at during the review</summary>

- 🟢 **General issues**: all looks good
- 🟡 **Security**: 1 issue found
- 🟢 **Testing**: all looks good
- 🟢 **Complexity**: all looks good
- 🟢 **Documentation**: all looks good
</details>

***

<details>
<summary>Sourcery is free for open source - if you like our reviews please consider sharing them ✨</summary>

- [X](https://twitter.com/intent/tweet?text=I%20just%20got%20an%20instant%20code%20review%20from%20%40SourceryAI%2C%20and%20it%20was%20brilliant%21%20It%27s%20free%20for%20open%20source%20and%20has%20a%20free%20trial%20for%20private%20code.%20Check%20it%20out%20https%3A//sourcery.ai)
- [Mastodon](https://mastodon.social/share?text=I%20just%20got%20an%20instant%20code%20review%20from%20%40SourceryAI%2C%20and%20it%20was%20brilliant%21%20It%27s%20free%20for%20open%20source%20and%20has%20a%20free%20trial%20for%20private%20code.%20Check%20it%20out%20https%3A//sourcery.ai)
- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https://sourcery.ai)
- [Facebook](https://www.facebook.com/sharer/sharer.php?u=https://sourcery.ai)

</details>

<sub>
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
</sub>
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T17:27:16Z
user: login: msugakov
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T17:48:43Z
user: login: davdhacs
body: lgtm

I would argue that "style" checks are a subset under "lint" (or "code analysis"?), but "style" is clear enough for engineers to find.
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T16:14:36Z
user: login: tommartensen
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T07:05:20Z

Review comments:
diff_hunk: @@ -197,6 +197,43 @@ jobs:
           image: rhacs-eng/${{ matrix.image }}:${{ steps.image-tag.outputs.image-tag }}-fast
           limit: 300
 
+  github-actions-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Download actionlint
+        id: get_actionlint
+        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.6.27
path: .github/workflows/style.yaml
user: login: sourcery-ai[bot]
body: **🚨 suggestion (security):** Consider verifying the security of piping bash from curl.

Using bash <(curl ...) directly exposes you to potential remote script changes. It might be safer to download the script, verify its checksum or pin a commit hash to prevent unexpected modifications.

Suggested implementation:

```
      - name: Download actionlint
        id: get_actionlint
        run: |
          # Download the pinned version of the script; replace <commit-hash> with a fixed commit identifier
          curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/<commit-hash>/scripts/download-actionlint.bash -o download-actionlint.bash
          # Verify the checksum of the downloaded script; replace <expected-checksum> with the correct SHA256 checksum
          echo "<expected-checksum>  download-actionlint.bash" | sha256sum -c -
          # Run the verified script to download the desired actionlint version
          bash download-actionlint.bash 1.6.27
        shell: bash

```

Note that you must:
1. Replace <commit-hash> with a specific commit identifier from the actionlint repository to pin the version.
2. Calculate the SHA256 checksum of download-actionlint.bash and replace <expected-checksum> with that value.
created_at: 2025-04-08T17:27:16Z
author_association: CONTRIBUTOR
diff_hunk: @@ -197,6 +197,43 @@ jobs:
           image: rhacs-eng/${{ matrix.image }}:${{ steps.image-tag.outputs.image-tag }}-fast
           limit: 300
 
+  github-actions-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Download actionlint
+        id: get_actionlint
+        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.6.27
path: .github/workflows/style.yaml
user: login: msugakov
body: I did (1) but I don't want to do (2) because it feels too much. For now I'd trust content on GitHub not to change when it's pinned to a specific commit.
created_at: 2025-04-08T17:48:43Z
author_association: CONTRIBUTOR

PR comments:
user: login: sourcery-ai[bot]
created_at: 2025-04-08T17:26:14Z
body: <!-- Generated by sourcery-ai[bot]: start review_guide -->

## Reviewer's Guide by Sourcery

This pull request consolidates the GitHub Actions workflow jobs from `lint.yml` into `style.yml`. This change simplifies the workflow configuration by removing the separate `lint.yml` file and integrating its jobs into the existing `style.yml` workflow.

_No diagrams generated as the changes look simple and do not need a visual representation._

### File-Level Changes

| Change | Details | Files |
| ------ | ------- | ----- |
| Consolidated GitHub Actions workflow jobs from `lint.yml` into `style.yml`. | <ul><li>Moved GitHub Actions linting job.</li><li>Moved Shellcheck job.</li><li>Moved OpenShift CI linting job.</li><li>Removed the `lint.yml` file.</li></ul> | `.github/workflows/style.yaml`<br/>`.github/workflows/lint.yml` |

---

<details>
<summary>Tips and commands</summary>

#### Interacting with Sourcery

- **Trigger a new review:** Comment `@sourcery-ai review` on the pull request.
- **Continue discussions:** Reply directly to Sourcery's review comments.
- **Generate a GitHub issue from a review comment:** Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with `@sourcery-ai issue` to create an issue from it.
- **Generate a pull request title:** Write `@sourcery-ai` anywhere in the pull
  request title to generate a title at any time. You can also comment
  `@sourcery-ai title` on the pull request to (re-)generate the title at any time.
- **Generate a pull request summary:** Write `@sourcery-ai summary` anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment `@sourcery-ai summary` on the pull request to
  (re-)generate the summary at any time.
- **Generate reviewer's guide:** Comment `@sourcery-ai guide` on the pull
  request to (re-)generate the reviewer's guide at any time.
- **Resolve all Sourcery comments:** Comment `@sourcery-ai resolve` on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
- **Dismiss all Sourcery reviews:** Comment `@sourcery-ai dismiss` on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  `@sourcery-ai review` to trigger a new review!
- **Generate a plan of action for an issue:** Comment `@sourcery-ai plan` on
  an issue to generate a plan of action for it.

#### Customizing Your Experience

Access your [dashboard](https://app.sourcery.ai) to:
- Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
- Change the review language.
- Add, remove or edit custom review instructions.
- Adjust other review settings.

#### Getting Help

- [Contact our support team](mailto:support@sourcery.ai) for questions or feedback.
- Visit our [documentation](https://docs.sourcery.ai) for detailed guides and information.
- Keep in touch with the Sourcery team by following us on [X/Twitter](https://x.com/SourceryAI), [LinkedIn](https://www.linkedin.com/company/sourcery-ai/) or [GitHub](https://github.com/sourcery-ai).

</details>

<!-- Generated by sourcery-ai[bot]: end review_guide -->
author_association: CONTRIBUTOR
user: login: rhacs-bot
created_at: 2025-04-08T17:58:07Z
body: [//]: # (meta:type=build)

Images are ready for the commit at c8470bb.

To use with deploy scripts, first `export MAIN_IMAGE_TAG=4.8.x-444-gc8470bb19a`.
author_association: CONTRIBUTOR
user: login: rhacs-bot
created_at: 2025-04-08T17:58:07Z
body: [//]: # (meta:type=build)

Images are ready for the commit at 27bf10a.

To use with deploy scripts, first `export MAIN_IMAGE_TAG=4.8.x-364-g8ab7d9ec06`.
author_association: CONTRIBUTOR
user: login: codecov[bot]
created_at: 2025-04-08T18:57:41Z
body: ## [Codecov](https://app.codecov.io/gh/stackrox/stackrox/pull/14922?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 48.96%. Comparing base [(`7ea6887`)](https://app.codecov.io/gh/stackrox/stackrox/commit/7ea688772e26babd81c57709942dd043b88656e9?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox) to head [(`c8470bb`)](https://app.codecov.io/gh/stackrox/stackrox/commit/c8470bb19a30c8acd680abe830583d4b8849b63c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox).
> Report is 5 commits behind head on master.

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##           master   #14922      +/-   ##
==========================================
- Coverage   48.96%   48.96%   -0.01%     
==========================================
  Files        2550     2550              
  Lines      187230   187230              
==========================================
- Hits        91679    91677       -2     
- Misses      88300    88302       +2     
  Partials     7251     7251              
```

| [Flag](https://app.codecov.io/gh/stackrox/stackrox/pull/14922/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox) | Coverage Δ | |
|---|---|---|
| [go-unit-tests](https://app.codecov.io/gh/stackrox/stackrox/pull/14922/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox) | `48.96% <ø> (-0.01%)` | :arrow_down: |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox#carryforward-flags-in-the-pull-request-comment) to find out more.

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/stackrox/stackrox/pull/14922?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox).

<details><summary> :rocket: New features to boost your workflow: </summary>

- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
author_association: NONE
user: login: msugakov
created_at: 2025-04-09T16:36:04Z
body: `style.yml` won for me because it has more lines and seems to be more active than `lint.yml`. That's why I decided to sacrifice the line history of `lint.yml` but not `style.yml`.
I can follow-up with a PR that renames `style.yml` -> `lint.yml` unless you think this might be an overkill.
author_association: CONTRIBUTOR
user: login: davdhacs
created_at: 2025-04-10T19:06:35Z
body: > `style.yml` won for me because it has more lines and seems to be more active than `lint.yml`. That's why I decided to sacrifice the line history of `lint.yml` but not `style.yml`. I can follow-up with a PR that renames `style.yml` -> `lint.yml` unless you think this might be an overkill.

I understand. And I think renaming after this would be overkill.
author_association: CONTRIBUTOR