opendesk

1name: Lint
2
3on:
4  pull_request:
5    branches:
6      - main
7      - main-hotfix
8      - develop
9
10jobs:
11  commit-lint:
12    name: Semantic Commits
13    runs-on: ubuntu-latest
14    steps:
15      - uses: actions/checkout@v3
16        with:
17          fetch-depth: 200
18      - uses: actions/setup-node@v3
19        with:
20          node-version: 24
21          check-latest: true
22      - name: Check commit titles
23        # Installed outside the repo: npm rejects the root package.json's yarn `link:` dependency.
24        run: |
25          cp commitlint.config.mjs "$RUNNER_TEMP/"
26          (cd "$RUNNER_TEMP" && npm install @commitlint/cli @commitlint/config-conventional)
27          "$RUNNER_TEMP/node_modules/.bin/commitlint" --config "$RUNNER_TEMP/commitlint.config.mjs" --verbose --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }}
28
29  linter:
30    name: 'Frappe Linter'
31    runs-on: ubuntu-latest
32    if: github.event_name == 'pull_request'
33
34    steps:
35      - uses: actions/checkout@v2
36
37      - name: Set up Python 3.10
38        uses: actions/setup-python@v2
39        with:
40          python-version: '3.14'
41
42      - name: Install and Run Pre-commit
43        uses: pre-commit/action@v3.0.1
44
45      - name: Download Semgrep rules
46        run: git clone --depth 1 https://github.com/frappe/semgrep-rules.git frappe-semgrep-rules
47
48      - name: Download semgrep
49        run: pip install semgrep
50
51      - name: Run Semgrep rules
52        run: semgrep ci --config ./frappe-semgrep-rules/rules --config r/python.lang.correctness
53
54  deps-vulnerable-check:
55    name: 'Vulnerable Dependency Check'
56    runs-on: ubuntu-latest
57
58    steps:
59      - uses: actions/checkout@v6
60
61      - uses: actions/setup-python@v6
62        with:
63          python-version: '3.14'
64
65      - name: Install and run pip-audit
66        run: |
67          pip install pip-audit
68          pip-audit --desc on .
69