Linting for shell and GitHub Actions (#206)

* Setup shell lint action
* Fix CMake lint
* Apply shellcheck
* Setup Actions linter
* Apply lint fixes for workflows
* Run Windows workflow when .bat files are changed, not .sh files
* Pin zizmor version
* Update dev docs for linters

.github/workflows/build_docs.yml

@@ -29,6 +29,8 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Checkout code
+        with:
+          persist-credentials: false
         uses: actions/checkout@v4
 
       - name: Install Python

.github/workflows/fypp_checks.yml

@@ -23,6 +23,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v3
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@v4
       with:
         python-version: "3.11"

.github/workflows/static_analysis.yml

@@ -10,14 +10,16 @@ on:
   # Triggers the workflow on pushes to open pull requests with code changes
   pull_request:
     paths:
-      - '.github/workflows/static_analysis.yml'
+      - '.github/workflows/*.yml'
       - '**.c'
       - '**.cpp'
       - '**.fypp'
       - '**.f90'
       - '**.F90'
       - '**.pf'
       - '**.py'
+      - '**.sh'
+      - '**CMakeLists.txt'
 
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
@@ -35,6 +37,8 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Checkout code
+        with:
+          persist-credentials: false
         uses: actions/checkout@v4
 
       - name: Install Python
@@ -63,13 +67,31 @@ jobs:
           cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=${BUILD_DIR} -DCMAKE_Fortran_FLAGS="-std=f2008" -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
 
       # Apply CMake linter, cmake-lint
-      - name: cmake
+      - name: cmake-lint
         if: always()
         run: |
           cd ${{ github.workspace }}
           . ftorch_venv/bin/activate
           cmake-lint $(find . -name CMakeLists.txt)
 
+      # Apply Shell linter, shellcheck
+      - name: shellcheck
+        if: always()
+        run: |
+          cd ${{ github.workspace }}
+          sudo apt install shellcheck
+          for FILE in $(find . -name "*.sh"); do
+            shellcheck ${FILE}
+          done
+
+      # Apply GitHub Actions linter, zizmor
+      - name: zizmor
+        if: always()
+        run: |
+          cd ${{ github.workspace }}
+          . ftorch_venv/bin/activate
+          zizmor .github/workflows/*.yml
+
       # Apply Fortran linter, fortitude
       # Configurable using the fortitude.toml file if present
       - name: fortitude source

.github/workflows/test_suite_ubuntu.yml

@@ -46,6 +46,8 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Checkout code
+        with:
+          persist-credentials: false
         uses: actions/checkout@v4
 
       - name: Install Python

.github/workflows/test_suite_windows.yml

@@ -11,14 +11,14 @@ on:
   pull_request:
     paths:
       - '.github/workflows/test_suite_windows.yml'
+      - '**.bat'
       - '**.c'
       - '**.cpp'
       - '**.fypp'
       - '**.f90'
       - '**.F90'
       - '**.pf'
       - '**.py'
-      - '**.sh'
       - '**CMakeLists.txt'
       - '**requirements.txt'
       - '**data/*'
@@ -53,6 +53,8 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Checkout code
+        with:
+          persist-credentials: false
         uses: actions/checkout@v4
 
       - name: Install Python

pages/developer.md

@@ -106,9 +106,17 @@ The tools we use are as follows on a language-by-language basis:
 * C++: [clang-format](https://clang.llvm.org/docs/ClangFormat.html) and [clang-tidy](https://clang.llvm.org/extra/clang-tidy/)
 * C: [clang-format](https://clang.llvm.org/docs/ClangFormat.html) and [clang-tidy](https://clang.llvm.org/extra/clang-tidy/)
 * Python: [ruff](https://docs.astral.sh/ruff/)
+* Shell: [ShellCheck](https://github.com/koalaman/shellcheck)
 * CMake: [cmake-format](https://github.com/cheshirekow/cmake_format)
+* GitHub Actions workflows: [zizmor](https://woodruffw.github.io/zizmor)
 
 Instructions on installing these tools can be found in their respective documentations.
+Note that all but ShellCheck may be installed with pip. A shortcut for doing
+this is to run the following from the base FTorch directory:
+```
+pip install -r requirements.txt
+```
+
 Contributors should run them over their code and ensure that it conforms before submitting
 a pull request. If there is a good reason to ignore a particular rule this should be
 justified in the pull request and ideally documented in the code.

requirements.txt

@@ -3,3 +3,4 @@ fortitude-lint==0.6.0
 clang-format==19.1.3
 clang-tidy==19.1.0
 cmakelang
+zizmor==0.9.2

run_integration_tests.sh

@@ -11,13 +11,12 @@
 
 set -eu
 
-CTEST_ARGS=$@
 EXAMPLES="1_SimpleNet 2_ResNet18 4_MultiIO 6_Autograd"
 BUILD_DIR=src/build
 
 for EXAMPLE in ${EXAMPLES}; do
-  pip -q install -r examples/${EXAMPLE}/requirements.txt
-  cd ${BUILD_DIR}/test/examples/${EXAMPLE}
-  ctest ${CTEST_ARGS}
+  pip -q install -r examples/"${EXAMPLE}"/requirements.txt
+  cd "${BUILD_DIR}"/test/examples/"${EXAMPLE}"
+  ctest "$@"
   cd -
 done