Brian Pooe
b791c20974
The validate job checks configs but never executes install.sh, which is what actually rots (apt repo URLs, GPG fingerprints, pinned checksums). New job runs the complete install plus --unlink as a normal user in a pristine ubuntu:24.04 container. Dependabot keeps the pinned GitHub Actions current monthly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
57 lines
1.9 KiB
YAML
57 lines
1.9 KiB
YAML
name: Validate
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
jobs:
|
|
dotfiles:
|
|
runs-on: ubuntu-24.04
|
|
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- name: Install validation tools
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install --yes build-essential curl file git gnupg procps shellcheck shfmt zsh
|
|
source install/lib/common.sh
|
|
source install/lib/brew.sh
|
|
source install/lib/packages.sh
|
|
install_wezterm
|
|
install_homebrew
|
|
brew install neovim starship stylua
|
|
echo "$BREW_PREFIX/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Restore Neovim plugins
|
|
env:
|
|
DOTFILES_CI: "1"
|
|
XDG_CONFIG_HOME: ${{ github.workspace }}/.config
|
|
run: nvim --headless "+Lazy! restore" +qa
|
|
|
|
- name: Validate
|
|
run: bin/check-dotfiles
|
|
|
|
# End-to-end installer test: the dotfiles job validates the configs but
|
|
# never runs install.sh itself, which is what rots (apt repo URLs, GPG
|
|
# fingerprints, pinned checksums). Run the full install as a normal user
|
|
# in a pristine container.
|
|
installer:
|
|
runs-on: ubuntu-24.04
|
|
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- name: Run full installer in a fresh container
|
|
run: |
|
|
docker run --rm -v "$PWD:/src:ro" ubuntu:24.04 bash -ec '
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends sudo curl ca-certificates git
|
|
useradd -m -s /bin/bash tester
|
|
echo "tester ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/tester
|
|
cp -r /src /home/tester/dotfiles
|
|
chown -R tester:tester /home/tester/dotfiles
|
|
su tester -c "cd ~/dotfiles && install/install.sh"
|
|
su tester -c "cd ~/dotfiles && install/install.sh --unlink"
|
|
'
|