[skip-changelog] Updating workflows from upstream (#3167)

cmaglie · web-flow · commit df06c8eb5d1a · 2026-04-14T11:25:43.000+02:00
* Update test-go-task GH workflow

* Updated check-license workflow

* Updated check-prettier-formatting-task workflow
diff --git a/.github/workflows/check-license.yml b/.github/workflows/check-license.yml
@@ -1,13 +1,9 @@
 # Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-license.md
 name: Check License
 
-env:
-  EXPECTED_LICENSE_FILENAME: LICENSE.txt
-  # SPDX identifier: https://spdx.org/licenses/
-  EXPECTED_LICENSE_TYPE: GPL-3.0
-
-# See: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
+# See: https://docs.github.com/actions/reference/workflows-and-actions/events-that-trigger-workflows
 on:
+  create:
   push:
     paths:
       - ".github/workflows/check-license.ya?ml"
@@ -25,12 +21,54 @@ on:
       - "[lL][iI][cC][eE][nN][cCsS][eE]*"
       - "[oO][fF][lL]*"
       - "[pP][aA][tT][eE][nN][tT][sS]*"
+  schedule:
+    # Run periodically to catch breakage caused by external changes.
+    - cron: "0 6 * * WED"
   workflow_dispatch:
   repository_dispatch:
 
 jobs:
+  run-determination:
+    runs-on: ubuntu-latest
+    permissions: {}
+    outputs:
+      result: ${{ steps.determination.outputs.result }}
+    steps:
+      - name: Determine if the rest of the workflow should run
+        id: determination
+        run: |
+          RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
+          # The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
+          if [[
+            "${{ github.event_name }}" != "create" ||
+            "${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
+          ]]; then
+            # Run the other jobs.
+            RESULT="true"
+          else
+            # There is no need to run the other jobs.
+            RESULT="false"
+          fi
+
+          echo "result=$RESULT" >>$GITHUB_OUTPUT
+
   check-license:
+    name: ${{ matrix.check-license.path }}
+    needs: run-determination
+    if: needs.run-determination.outputs.result == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    strategy:
+      fail-fast: false
+
+      matrix:
+        check-license:
+          - path: .
+            expected-filename: LICENSE.txt
+            # SPDX identifier: https://spdx.org/licenses/
+            expected-type: GPL-3.0
 
     steps:
       - name: Checkout repository
@@ -42,25 +80,43 @@ jobs:
           ruby-version: ruby # Install latest version
 
       - name: Install licensee
-        run: gem install licensee
+        run: |
+          gem install \
+            licensee
 
-      - name: Check license file
+      - name: Check license file for ${{ matrix.check-license.path }}
         run: |
           EXIT_STATUS=0
+
+          # Go into folder path
+          cd ./${{ matrix.check-license.path }}
+
           # See: https://github.com/licensee/licensee
           LICENSEE_OUTPUT="$(licensee detect --json --confidence=100)"
 
-          DETECTED_LICENSE_FILE="$(echo "$LICENSEE_OUTPUT" | jq .matched_files[0].filename | tr --delete '\r')"
+          DETECTED_LICENSE_FILE="$(
+            echo "$LICENSEE_OUTPUT" \
+            | \
+            jq .matched_files[0].filename \
+            | \
+            tr --delete '\r'
+          )"
           echo "Detected license file: $DETECTED_LICENSE_FILE"
-          if [ "$DETECTED_LICENSE_FILE" != "\"${EXPECTED_LICENSE_FILENAME}\"" ]; then
-            echo "::error file=${DETECTED_LICENSE_FILE}::detected license file $DETECTED_LICENSE_FILE doesn't match expected: $EXPECTED_LICENSE_FILENAME"
+          if [ "$DETECTED_LICENSE_FILE" != "\"${{ matrix.check-license.expected-filename }}\"" ]; then
+            echo "::error file=${DETECTED_LICENSE_FILE}::detected license file $DETECTED_LICENSE_FILE doesn't match expected: ${{ matrix.check-license.expected-filename }}"
             EXIT_STATUS=1
           fi
 
-          DETECTED_LICENSE_TYPE="$(echo "$LICENSEE_OUTPUT" | jq .matched_files[0].matched_license | tr --delete '\r')"
+          DETECTED_LICENSE_TYPE="$(
+            echo "$LICENSEE_OUTPUT" \
+            | \
+            jq .matched_files[0].matched_license \
+            | \
+            tr --delete '\r'
+          )"
           echo "Detected license type: $DETECTED_LICENSE_TYPE"
-          if [ "$DETECTED_LICENSE_TYPE" != "\"${EXPECTED_LICENSE_TYPE}\"" ]; then
-            echo "::error file=${DETECTED_LICENSE_FILE}::detected license type $DETECTED_LICENSE_TYPE doesn't match expected \"${EXPECTED_LICENSE_TYPE}\""
+          if [ "$DETECTED_LICENSE_TYPE" != "\"${{ matrix.check-license.expected-type }}\"" ]; then
+            echo "::error file=${DETECTED_LICENSE_FILE}::detected license type $DETECTED_LICENSE_TYPE doesn't match expected \"${{ matrix.check-license.expected-type }}\""
             EXIT_STATUS=1
           fi
 
diff --git a/.github/workflows/check-prettier-formatting-task.yml b/.github/workflows/check-prettier-formatting-task.yml
@@ -1,14 +1,21 @@
 # Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/check-prettier-formatting-task.md
 name: Check Prettier Formatting
 
-# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows
+# See: https://docs.github.com/actions/reference/workflows-and-actions/events-that-trigger-workflows
 on:
+  create:
   push:
     paths:
       - ".github/workflows/check-prettier-formatting-task.ya?ml"
+      - ".npmrc"
+      - "go.mod"
+      - "go.sum"
       - "Taskfile.ya?ml"
       - "**/.prettierignore"
       - "**/.prettierrc*"
+      # Prettier-covered file patterns are defined by:
+      # https://github.com/github-linguist/linguist/blob/main/lib/linguist/languages.yml
+      #
       # CSS
       - "**.css"
       - "**.wxss"
@@ -88,6 +95,13 @@ on:
       - "**.mkdn?"
       - "**.ronn"
       - "**.workbook"
+      # TOML
+      - "**/Cargo.lock"
+      - "**/Cargo.toml.orig"
+      - "**/Gopkg.lock"
+      - "**/Pipfile"
+      - "**/pdm.lock"
+      - "**.toml"
       # YAML
       - "**/.clang-format"
       - "**/.clang-tidy"
@@ -102,6 +116,9 @@ on:
   pull_request:
     paths:
       - ".github/workflows/check-prettier-formatting-task.ya?ml"
+      - ".npmrc"
+      - "go.mod"
+      - "go.sum"
       - "Taskfile.ya?ml"
       - "**/.prettierignore"
       - "**/.prettierrc*"
@@ -184,6 +201,13 @@ on:
       - "**.mkdn?"
       - "**.ronn"
       - "**.workbook"
+      # TOML
+      - "**/Cargo.lock"
+      - "**/Cargo.toml.orig"
+      - "**/Gopkg.lock"
+      - "**/Pipfile"
+      - "**/pdm.lock"
+      - "**.toml"
       # YAML
       - "**/.clang-format"
       - "**/.clang-tidy"
@@ -195,25 +219,65 @@ on:
       - "**.rviz"
       - "**.sublime-syntax"
       - "**.syntax"
+  schedule:
+    # Run periodically to catch breakage caused by external changes.
+    - cron: "0 4 * * WED"
   workflow_dispatch:
   repository_dispatch:
 
 jobs:
+  run-determination:
+    runs-on: ubuntu-latest
+    permissions: {}
+    outputs:
+      result: ${{ steps.determination.outputs.result }}
+    steps:
+      - name: Determine if the rest of the workflow should run
+        id: determination
+        run: |
+          RELEASE_BRANCH_REGEX="refs/heads/[0-9]+.[0-9]+.x"
+          # The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
+          if [[
+            "${{ github.event_name }}" != "create" ||
+            "${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX
+          ]]; then
+            # Run the other jobs.
+            RESULT="true"
+          else
+            # There is no need to run the other jobs.
+            RESULT="false"
+          fi
+
+          echo "result=$RESULT" >>$GITHUB_OUTPUT
+
   check:
+    needs: run-determination
+    if: needs.run-determination.outputs.result == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
 
-      - name: Install Task
-        uses: arduino/setup-task@v2
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
         with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          version: 3.x
+          node-version-file: package.json
 
       - name: Format with Prettier
-        run: task general:format-prettier
+        run: |
+          go tool \
+            github.com/go-task/task/v3/cmd/task general:format-prettier
 
       - name: Check formatting
-        run: git diff --color --exit-code
+        run: |
+          git diff \
+            --color \
+            --exit-code
diff --git a/.github/workflows/test-go-task.yml b/.github/workflows/test-go-task.yml
@@ -1,9 +1,6 @@
 # Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/test-go-task.md
 name: Test Go
 
-env:
-  COVERAGE_ARTIFACT: coverage-data
-
 # See: https://docs.github.com/actions/reference/workflows-and-actions/events-that-trigger-workflows
 on:
   create:
@@ -63,6 +60,8 @@ jobs:
   tests-collector:
     runs-on: ubuntu-latest
     needs: run-determination
+    permissions:
+      contents: read
     if: needs.run-determination.outputs.result == 'true'
     outputs:
       tests-data: ${{ steps.collection.outputs.tests-data }}
@@ -78,8 +77,11 @@ jobs:
 
   test-integration:
     needs: tests-collector
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
+
       matrix:
         operating-system:
           - windows-latest
@@ -114,12 +116,14 @@ jobs:
         uses: actions/upload-artifact@v6
         with:
           if-no-files-found: error
-          name: ${{ env.COVERAGE_ARTIFACT }}-test-integration-${{ matrix.operating-system }}-${{ matrix.tests }}
+          name: coverage-data-test-integration-${{ matrix.operating-system }}-${{ matrix.tests }}
           path: |
             ./coverage_integration_*.txt
 
   test:
     needs: run-determination
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -154,7 +158,7 @@ jobs:
         uses: actions/upload-artifact@v6
         with:
           if-no-files-found: error
-          name: ${{ env.COVERAGE_ARTIFACT }}-test-${{ matrix.operating-system }}
+          name: coverage-data-test-${{ matrix.operating-system }}
           path: |
             ./coverage_unit.txt
 
@@ -163,6 +167,8 @@ jobs:
     needs:
       - test
       - test-integration
+    permissions:
+      contents: read
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -178,7 +184,7 @@ jobs:
       - name: Download coverage data artifact
         uses: actions/download-artifact@v7
         with:
-          pattern: ${{ env.COVERAGE_ARTIFACT }}-*
+          pattern: coverage-data-*
           merge-multiple: true
 
       - name: Merge all code coverage artifacts
