github-featured / comet-ml--opik

发布

0 发布 8,340 Git 标签

RSS 订阅源
  • 2.0.67-5692 f360de28d8
    比较

    [OPIK-6584] [CI] feat: lint workflows at info+ severity; diff-scoped on CI mirroring pre-commit (#7102)

    frostbyte_neo 发布于 2026-06-17 08:38:10 +00:00

    • [OPIK-6584] [INFRA] [CI] feat: lint all workflows; drop diff-scope and severity override
    • actionlint.yml: remove paths: filter, diff-scoped lint scaffolding, and
      SHELLCHECK_OPTS=--severity=warning. Now runs bare actionlint against
      every workflow file on every PR.
    • .hooks/pre-commit: mirror the change locally — when any workflow or
      composite-action file is staged, run actionlint across the full tree
      at default severity.

    Verified locally: 0 findings across 75 workflow files at default (info+)
    severity, including with --severity=style. The cleanup from subtasks
    OPIK-6580/6581/6582/6583 left the tree fully clean, so removing the
    opt-outs is a pure tightening — no findings being newly surfaced.

    • fix(pre-commit): keep actionlint scoped to staged files

    The first pass of this PR over-tightened the local hook to lint the full
    workflow tree on every commit that touched a workflow file. That mirrors
    what CI does, but defeats the point of a pre-commit hook — it should
    fast-check the developer's actual changes, not redundantly re-do the
    full-tree scan CI runs on every PR.

    Restore the staged-files scoping (including composite-action caller
    resolution) that was there before this PR. The only effective change vs.
    the prior hook is dropping SHELLCHECK_OPTS=--severity=warning, which is
    the same severity tightening CI got.

    • fix(workflows): resolve SC2015 in publish_helm_chart and SC2002 in release

    CI surfaced two findings once the severity floor dropped to default info+:

    • publish_helm_chart.yaml: $(cmd && cmd2 || true) triggers SC2015 (A &&
      B || C is not if-then-else — C runs when A fails too). Rewrote as
      $(cmd && cmd2) || NEW_CHART_TIME="" so the fallback only fires on
      command-substitution failure. Functional behavior is unchanged — both
      forms leave NEW_CHART_TIME empty on failure, and the existing
      [ -n "$NEW_CHART_TIME" ] guard handles that.

    • release.yaml: cat Chart.yaml | grep -E ... triggers SC2002 (useless
      cat). Inlined to grep -E ... Chart.yaml.

    These were latent findings the prior --severity=warning floor was
    masking. Catching them here is exactly the regression-guard behavior
    this PR's whole purpose is to enable.

    • refactor(actionlint): restore paths: filter — lint only runs when workflows change

    Drop the all-PRs trigger from the previous pass. The ticket's argument
    for removing the paths: filter ("regressions can land via PRs that don't
    touch .github/") doesn't actually hold — actionlint only reads workflow
    YAML, so a PR that doesn't touch .github/ can't regress workflow lint.

    Keep:

    • Full-tree scan when the job DOES run (catches cross-workflow breakage
      from edits to composite actions under .github/actions/ that the prior
      diff-scoping logic needed scaffolding to handle).
    • Default info+ severity (no SHELLCHECK_OPTS=--severity=warning).

    Net effect vs. main: same trigger scope, but when the job runs it lints
    the whole tree at default severity instead of just the diff at
    warning+.

    • refactor(actionlint): keep diff-scoped CI; drop only the severity override

    Reverts the full-tree CI scan introduced earlier on this branch. After
    discussion with the reviewer, the file-scope tightening doesn't pay for
    itself: CI is the safety net but it's the same composite-action
    caller-resolution logic that the pre-commit hook already does, and
    running on every workflow PR has the friction cost of "unrelated PR has
    to fix something it didn't touch."

    Final net effect of this PR on .github/workflows/actionlint.yml vs.
    main: 3-line removal of the SHELLCHECK_OPTS=--severity=warning override.
    Everything else (paths filter, fetch-depth, diff scaffolding, composite-
    action caller resolution) is preserved.

    The post-rebase full-tree CI probe (previous push on this branch) ran
    green at default info+ severity, confirming the repository tree is clean
    at the new severity floor and no additional latent findings exist.

    • docs(pre-commit): remove stale comment about CI full-tree behavior

    Leftover from the brief full-tree CI experiment earlier on this branch.
    CI is diff-scoped (matches the hook) and gated by paths: filter — not
    'full tree on every PR'. The two-line comment was misleading; delete.

    下载附件