matrix/.gitea/workflows/lint.yml

name: Lint

on:
  push:
    branches: ["**"]
  pull_request:
    branches: ["**"]

jobs:
  shell-lint:
    name: Shell (shellcheck)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Install shellcheck
        run: apt-get update -qq && apt-get install -y -qq shellcheck

      - name: Run shellcheck
        run: find . -name "*.sh" -exec shellcheck {} +

  js-lint:
    name: JS (eslint)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Install ESLint
        run: npm install --save-dev eslint@8

      - name: Run ESLint
        run: npx eslint --ext .js hookshot/

  hooks-no-secrets:
    name: No secrets in webhook configs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      # deploy/hooks-*.json are public; their secrets come from
      # /etc/webhook/secrets.env on each LXC via `{{ getenv "..." }}`.
      - name: Reject literal secrets
        run: |
          if grep -nE '[0-9a-fA-F]{32,}' deploy/hooks-*.json; then
            echo "::error::A literal secret/token is committed in deploy/hooks-*.json. Use {{ getenv \"NAME\" | js }} and put the value in /etc/webhook/secrets.env on the LXC."
            exit 1
          fi

  landing-fresh:
    name: Landing page is rendered (matrix #11)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      # index.html's feature groups, comparison table and inlined CSS are
      # generated from landing/data/*.json + landing/style.css. Fail if someone
      # edited the data without re-running the renderer (or edited the output).
      - name: Check landing/index.html matches its sources
        run: python3 landing/build.py --check

  python-lint:
    name: Python (ruff)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Install ruff
        run: |
          curl -sSL https://github.com/astral-sh/ruff/releases/download/0.8.6/ruff-x86_64-unknown-linux-gnu.tar.gz \
            | tar -xz --strip-components=1
          mv ruff /usr/local/bin/ruff

      - name: Check syntax errors
        run: ruff check matrixbot/ --select E9,F63,F7,F82 --output-format=github

      - name: Run full lint
        run: ruff check matrixbot/ --output-format=github

  python-audit:
    name: Python deps (pip-audit)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Install Python 3.10 and pip-audit
        run: |
          # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary
          curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \
            | tar -xz -C /opt
          # Install bot deps + pip-audit into the same env; --local below avoids
          # pip-audit creating an internal venv (ensurepip fails on standalone builds)
          /opt/python/bin/pip install --upgrade pip setuptools
          /opt/python/bin/pip install pip-audit -r matrixbot/requirements.txt

      - name: Audit matrixbot dependencies
        # --local scans the env without spawning a venv (required for standalone Python)
        # CVE-2026-3219 is in pip itself, not our code — ignore it explicitly.
        # The filelock CVEs (fixed in 4.2.1) are in pip-audit's own dependency
        # (CacheControl[filecache]); the bot doesn't use filelock, and 4.2+
        # needs Python 3.11, which this 3.10 audit env can't install.
        run: >-
          /opt/python/bin/pip-audit --local
          --ignore-vuln CVE-2026-3219
          --ignore-vuln CVE-2026-112906 --ignore-vuln CVE-2026-112907
          --ignore-vuln CVE-2026-112913 --ignore-vuln CVE-2026-112914
          --ignore-vuln CVE-2026-112937 --ignore-vuln CVE-2026-112940

  secret-scan:
    name: Secret scan (gitleaks)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Install gitleaks
        run: |
          curl -sSL --retry 3 --retry-delay 5 --max-time 120 \
            https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
            | tar -xz gitleaks
          mv gitleaks /usr/local/bin/gitleaks

      - name: Scan for secrets
        run: |
          # Scan application code directories — deploy/ is excluded because
          # it contains intentional Gitea webhook HMAC secrets in hooks-lxc*.json
          for dir in matrixbot/ hookshot/ .gitea/ systemd/ cinny/ landing/; do
            [ -d "$dir" ] || continue
            gitleaks detect --source "$dir" --no-git --config .gitleaks.toml \
              --redact --exit-code 1
          done