mirror of
https://github.com/HDFGroup/hdf5.git
synced 2026-09-25 04:09:44 +03:00
* Harden scheduled/downstream build workflows against zizmor findings
Fix all zizmor static-analysis findings in the scheduled/downstream build
workflows without changing behavior:
- template-injection: move ${{ }} expressions out of run: script bodies
into step-level env: blocks referenced as shell variables
- artipacked: add persist-credentials: false to actions/checkout steps
(none of these jobs push to git)
- excessive-permissions: add top-level 'permissions: contents: read' to
macos-26-matrix.yml (other files already restrict permissions)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Address Copilot review comments on PR #6544
- Drop unnecessary command substitution in daily-schedule.yml's
FILE_NAME_BASE assignment
- Name the two env-block steps in daily-build.yml that previously ran
unnamed (easier to scan in logs)
- Quote $GITHUB_OUTPUT in the getinputs step
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* Remove extra blank lines.
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
120 lines
4.2 KiB
YAML
120 lines
4.2 KiB
YAML
name: Link Checker
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches: [develop]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
check-links:
|
|
name: Check Documentation Links
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false # Prevents tokens from being written to Git config files
|
|
|
|
- name: Install System Dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends \
|
|
libunwind-dev \
|
|
graphviz \
|
|
doxygen \
|
|
cmake
|
|
|
|
- name: Build Documentation
|
|
id: build_docs
|
|
run: |
|
|
mkdir build
|
|
cd build
|
|
cmake -DHDF5_BUILD_DOC:BOOL=ON ..
|
|
make doxygen
|
|
echo "html_path=$(pwd)/hdf5lib_docs/html" >> $GITHUB_OUTPUT
|
|
|
|
- name: Run Comprehensive Link Check
|
|
id: lychee
|
|
uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
|
|
with:
|
|
args: >
|
|
--base ${{ steps.build_docs.outputs.html_path }}
|
|
--max-retries 4
|
|
--max-concurrency 4
|
|
--retry-wait-time 10
|
|
--timeout 30
|
|
--accept 200..=299,429
|
|
--user-agent "Mozilla/5.0 (compatible; Lychee/v0.1)"
|
|
--skip-missing
|
|
--exclude ".*%23.*"
|
|
--exclude "eigen.tuxfamily.org"
|
|
--exclude "gnu.org"
|
|
--exclude "en.wikipedia.org"
|
|
--exclude "help.hdfgroup.org"
|
|
--exclude "libpng.org"
|
|
--exclude "my.cdash.org"
|
|
--exclude "www.oreilly.com"
|
|
--exclude "preshing.com"
|
|
--exclude "semver.org"
|
|
--exclude "sourceforge.net"
|
|
--exclude "www.youtube.com"
|
|
--exclude "youtu.be"
|
|
--exclude "hdfeos.org"
|
|
--exclude "github.com"
|
|
--exclude "stackoverflow.com"
|
|
--exclude "reddit.com"
|
|
--exclude "twitter.com"
|
|
--exclude "linkedin.com"
|
|
--exclude "web.cels.anl.gov"
|
|
--exclude "www.doxygen.org"
|
|
--exclude "www.doxygen.nl"
|
|
"${{ steps.build_docs.outputs.html_path }}/**/*.html"
|
|
output: lychee-report.md
|
|
format: markdown
|
|
jobSummary: false
|
|
# Let the action fail naturally - we'll handle it in the summary step
|
|
fail: true
|
|
|
|
- name: Publish Report to Job Summary
|
|
if: always()
|
|
env:
|
|
LYCHEE_OUTCOME: ${{ steps.lychee.outcome }}
|
|
run: |
|
|
echo "## 🔗 Link Checker Report" >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
# Check if lychee step succeeded or failed
|
|
if [ "$LYCHEE_OUTCOME" = "success" ]; then
|
|
echo "✅ **No broken links found!**" >> "$GITHUB_STEP_SUMMARY"
|
|
elif [ "$LYCHEE_OUTCOME" = "failure" ]; then
|
|
# Count actual broken links marked with the ❌ emoji.
|
|
# Default to 0 if grep finds nothing or fails.
|
|
FAILED_COUNT=$(grep -c "❌" lychee-report.md 2>/dev/null || echo 0)
|
|
|
|
if [ "$FAILED_COUNT" -gt 0 ]; then
|
|
echo "❌ **Found $FAILED_COUNT broken link(s)!**" >> "$GITHUB_STEP_SUMMARY"
|
|
else
|
|
# If the step failed but no broken links found, it's likely a different error
|
|
echo "⚠️ **Link checker encountered an error.**" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "This may indicate a configuration, network, or file access issue." >> "$GITHUB_STEP_SUMMARY"
|
|
fi
|
|
else
|
|
echo "⚠️ **Link checker step was skipped or cancelled.**" >> "$GITHUB_STEP_SUMMARY"
|
|
fi
|
|
|
|
echo "" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "### Full Report:" >> "$GITHUB_STEP_SUMMARY"
|
|
if [ -f "lychee-report.md" ]; then
|
|
echo '```' >> "$GITHUB_STEP_SUMMARY"
|
|
cat lychee-report.md >> "$GITHUB_STEP_SUMMARY"
|
|
echo '```' >> "$GITHUB_STEP_SUMMARY"
|
|
else
|
|
echo "No detailed report available." >> "$GITHUB_STEP_SUMMARY"
|
|
fi
|