Files
Kristopher Overholt e15aa4b918 Secure CI workflows with zizmor ahead of enforced rollout (#1872)
* ci: pin actions to SHAs and harden workflows with zizmor auto-fixes

* ci: set least-privilege GITHUB_TOKEN permissions on workflows

* ci: move PR/issue context into env vars to prevent template injection
2026-06-26 12:31:45 -05:00

49 lines
1.5 KiB
YAML

name: Go Fmt
on:
pull_request:
paths:
- '**.go'
permissions:
contents: read
jobs:
gofmt:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
fetch-depth: 0 # Fetch all history for all tags and branches
persist-credentials: false
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
go-version: '1.25'
- name: Run gofmt on changed files
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
# List changed Go files in the pull request.
# The `|| true` is to prevent the command from failing if no go files are found
changed_files=$(git diff --name-only --diff-filter=ACMRT "${BASE_SHA}..${HEAD_SHA}" | grep '\.go$' || true)
if [ -z "$changed_files" ]; then
echo "No Go files changed in this PR."
exit 0
fi
echo "Checking formatting for the following files:"
echo "$changed_files"
# Check formatting of changed files
unformatted_files=$(gofmt -l $changed_files)
if [ -n "$unformatted_files" ]; then
echo "Unformatted Go files found:"
echo "$unformatted_files"
exit 1
else
echo "All changed Go files are formatted correctly."
fi