chore(ci): create a pipeline for linting YAML workflow files

.github/workflows/build-balena-disk-image.yaml

@@ -37,15 +37,15 @@ jobs:
       - name: Get base board
         run: |
           if [ "${{ matrix.board }}" == 'pi1' ]; then
-            echo "BALENA_IMAGE=raspberry-pi" >> $GITHUB_ENV
+            echo "BALENA_IMAGE=raspberry-pi" >> "$GITHUB_ENV"
           elif [ "${{ matrix.board }}" == 'pi2' ]; then
-            echo "BALENA_IMAGE=raspberry-pi2" >> $GITHUB_ENV
+            echo "BALENA_IMAGE=raspberry-pi2" >> "$GITHUB_ENV"
           elif [ "${{ matrix.board }}" == 'pi3' ]; then
-            echo "BALENA_IMAGE=raspberrypi3" >> $GITHUB_ENV
+            echo "BALENA_IMAGE=raspberrypi3" >> "$GITHUB_ENV"
           elif [ "${{ matrix.board }}" == 'pi4' ]; then
-            echo "BALENA_IMAGE=raspberrypi4-64" >> $GITHUB_ENV
+            echo "BALENA_IMAGE=raspberrypi4-64" >> "$GITHUB_ENV"
           elif [ "${{ matrix.board }}" == 'pi5' ]; then
-            echo "BALENA_IMAGE=raspberrypi5" >> $GITHUB_ENV
+            echo "BALENA_IMAGE=raspberrypi5" >> "$GITHUB_ENV"
           fi
 
       - name: balena CLI Action - download

.github/workflows/build-webview.yaml

@@ -33,13 +33,13 @@ jobs:
       - name: Set buildx arguments
         id: prepare
         run: |
-          echo ::set-output name=buildx_args::\
-            --cache-from "screenly/ose-qt-builder:latest" \
-            --output "type=image,push=true" \
-            --build-arg "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
-            --build-arg "GIT_HASH=$GITHUB_SHA" \
-            --build-arg "GIT_SHORT_HASH=$(git rev-parse --short HEAD)" \
-            --build-arg "GIT_BRANCH=$GITHUB_REF_NAME"
+          echo "buildx_args=\
+            --cache-from \"screenly/ose-qt-builder:latest\" \
+            --output \"type=image,push=true\" \
+            --build-arg \"BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\" \
+            --build-arg \"GIT_HASH=$GITHUB_SHA\" \
+            --build-arg \"GIT_SHORT_HASH=$(git rev-parse --short HEAD)\" \
+            --build-arg \"GIT_BRANCH=$GITHUB_REF_NAME\"" >> "$GITHUB_OUTPUT"
 
       - name: Building container
         run: |

.github/workflows/deploy-website.yaml

@@ -49,7 +49,7 @@ jobs:
           python bin/build-pi-imager-json.py > _site/rpi-imager.json
 
           # Make sure it's valid
-          cat _site/rpi-imager.json | jq
+          jq . < _site/rpi-imager.json
 
           # Copy in static files. This is to be migrated to Hugo later.
           cp -rf assets _site/

.github/workflows/docker-build.yaml

@@ -97,21 +97,22 @@ jobs:
 
       - name: Set Docker tag
         run: |
-          echo "GIT_SHORT_HASH=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
-          echo "BOARD=${{ matrix.board }}" >> $GITHUB_ENV
-          echo "SHM_SIZE=256mb" >> $GITHUB_ENV
+          {
+            echo "GIT_SHORT_HASH=$(git rev-parse --short HEAD)"
+            echo "BOARD=${{ matrix.board }}"
+            echo "SHM_SIZE=256mb"
+          } >> "$GITHUB_ENV"
 
       - name: Prepare Balena file
         run: |
-          # Generage a docker-compose file for Balena with the correct board
+          # Generate a docker-compose file for Balena with the correct board
           mkdir -p balena-deploy
 
           # Copy in the Balena yaml file
           cp balena.yml balena-deploy/
 
           # Generate the docker-compose file
-          cat docker-compose.balena.yml.tmpl | \
-            envsubst > balena-deploy/docker-compose.yml
+          envsubst < docker-compose.balena.yml.tmpl > balena-deploy/docker-compose.yml
 
           # Remove bind mounts to `/dev/vchiq` for Raspberry Pi 5
           if [ "${{ matrix.board }}" == "pi5" ]; then

.github/workflows/generate-openapi-schema.yml

@@ -39,7 +39,6 @@ on:
         description: 'Upload the OpenAPI schema as a release artifact'
         required: true
         type: boolean
-        default: false
       tag:
         description: 'Tag to be used for the release'
         required: true

.github/workflows/lint-workflows.yml

@@ -0,0 +1,33 @@
+name: Lint GitHub Workflows
+
+on:
+  pull_request:
+    branches:
+      - master
+    paths:
+      - '**/*.yml'
+      - '**/*.yaml'
+      - '.github/workflows/lint-workflows.yml'
+  push:
+    branches:
+      - master
+    paths:
+      - '**/*.yml'
+      - '**/*.yaml'
+      - '.github/workflows/lint-workflows.yml'
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install actionlint
+        run: |
+          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+        shell: bash
+
+      - name: Run actionlint
+        run: ./actionlint -color
+        shell: bash

.github/workflows/python-lint.yaml

@@ -44,5 +44,5 @@ jobs:
     - name: Analyzing the code with flake8
       run: |
         if [ -n "$(git ls-files '*.py')" ]; then
-          poetry run flake8 $(git ls-files '*.py')
+          git ls-files '*.py' | xargs poetry run flake8
         fi

.github/workflows/sbom.yaml

@@ -9,6 +9,9 @@ on:
       - 'poetry.lock'
 
 jobs:
+  run-tests:
+    uses: ./.github/workflows/docker-test.yaml
+
   js-sbom:
     needs: run-tests
     runs-on: ubuntu-latest