check.yml

name: Check

# Проверки dev-guardrails: форматы, ссылки, опечатки, workflows, секреты,
# уязвимости лока и заголовки коммитов. Заголовки коммитов проверяются здесь
# по диапазону пуша, потому что коммиты уходят прямо в main и pr-title.yml их
# не видит, а release-please читает именно историю.
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3

      - name: Install
        run: make install

      - name: Run checks
        run: mise run check
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Commit messages
        env:
          FROM: ${{ github.event.pull_request.base.sha || github.event.before }}
          TO: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          if [ "$FROM" = "0000000000000000000000000000000000000000" ]; then
            FROM="$TO~1"
          fi
          commitlint --from "$FROM" --to "$TO"

      - name: Secrets
        run: betterleaks git --log-opts="$FROM..$TO" --no-banner .
        env:
          FROM: ${{ github.event.pull_request.base.sha || github.event.before }}
          TO: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Vulnerabilities
        run: osv-scanner scan source --lockfile uv.lock