x509-certificate-exporter/.github/workflows/lint.yaml

name: Linting

# Run only what's relevant to the change. On a PR, dorny/paths-filter
# inspects the diff against the base ref to decide which linters to fire.
# When called from another workflow (e.g. release), every linter runs —
# release time is not where to be clever about scope.
#
# Not wired on `push: main` on purpose: the same diff already ran on the
# PR that produced that commit.
on:
  pull_request:
  workflow_call:
    inputs:
      skip-go:
        description: Skip the Go linter.
        type: boolean
        default: false
      skip-helm:
        description: Skip the Helm linter.
        type: boolean
        default: false
      skip-renovate:
        description: Skip the Renovate config validator.
        type: boolean
        default: false
      skip-markdown:
        description: Skip the Markdown linter.
        type: boolean
        default: false

# Read-only by default — every job here just inspects the source tree
# and reports findings. Override at the job level if a future job ever
# needs to write back (it shouldn't).
permissions:
  contents: read

# Silence Dagger's Cloud upload and analytics paths globally.
env:
  DAGGER_NO_NAG: "1"
  DAGGER_CLOUD_TOKEN: ""
  DO_NOT_TRACK: "1"

jobs:
  changes:
    name: Detect changed paths
    # On workflow_call there is no "base ref" semantics; skip detection
    # and let each linter run unconditionally via the if: guard below.
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    outputs:
      go: ${{ steps.filter.outputs.go }}
      helm: ${{ steps.filter.outputs.helm }}
      renovate: ${{ steps.filter.outputs.renovate }}
      markdown: ${{ steps.filter.outputs.markdown }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 1
      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
        id: filter
        with:
          # `dagger/**` is included in every filter because a change to
          # the pipeline definition (image versions, lint args, etc.)
          # affects what the linter actually does.
          filters: |
            go:
              - '**/*.go'
              - 'go.mod'
              - 'go.sum'
              - '.golangci.yml'
              - 'dagger/**'
            helm:
              - 'chart/**'
              - 'dagger/**'
            renovate:
              - 'renovate.json5'
              - 'dagger/**'
            markdown:
              # Mirror the `ignores` list in .markdownlint-cli2.jsonc so a
              # change to one of those files doesn't pointlessly fire the
              # linter. Auto-generated outputs (CHANGELOG.md from
              # release-please, chart/README.md from helm-docs) and AI
              # assistant files (CLAUDE.md, AGENTS.md) are skipped by the
              # linter itself; keeping the filter in lockstep avoids a
              # job-with-zero-files on release-please / chart-readme PRs.
              - '**/*.md'
              - '!CHANGELOG.md'
              - '!chart/README.md'
              - '!CLAUDE.md'
              - '!AGENTS.md'
              - '.markdownlint-cli2.jsonc'
              - 'dagger/**'

  lint-go:
    name: Go
    needs: changes
    if: |
      always() &&
      !inputs.skip-go &&
      (github.event_name != 'pull_request' || needs.changes.outputs.go == 'true')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 1
      - uses: ./.github/actions/dagger
        with:
          args: lint-go

  lint-helm:
    name: Helm
    needs: changes
    if: |
      always() &&
      !inputs.skip-helm &&
      (github.event_name != 'pull_request' || needs.changes.outputs.helm == 'true')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 1
      - uses: ./.github/actions/dagger
        with:
          args: lint-helm

  lint-renovate:
    name: Renovate config
    needs: changes
    if: |
      always() &&
      !inputs.skip-renovate &&
      (github.event_name != 'pull_request' || needs.changes.outputs.renovate == 'true')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 1
      - uses: ./.github/actions/dagger
        with:
          args: lint-renovate

  lint-markdown:
    name: Markdown
    needs: changes
    if: |
      always() &&
      !inputs.skip-markdown &&
      (github.event_name != 'pull_request' || needs.changes.outputs.markdown == 'true')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 1
      - uses: ./.github/actions/dagger
        with:
          args: lint-markdown