dev: Use a common action-dev-check (#1895)

This change updates to the v28 devcontainer, which includes an extracted
`action-dev-check` script that replaces the inlined just recipe. This
change also renames some recipes (like action-lint, md-lint, and
sh-lint) to be uniform with the recipes in other repos.

Signed-off-by: Oliver Gould <ver@buoyant.io>

Signed-off-by: Oliver Gould <ver@buoyant.io>

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
 	"name": "linkerd2-proxy",
-	"image": "ghcr.io/linkerd/dev:v26",
+	"image": "ghcr.io/linkerd/dev:v28",
 	"extensions": [
 		"DavidAnson.vscode-markdownlint",
 		"kokakiwi.vscode-just",

.github/actions/list-changed-crates/Dockerfile

@@ -1,3 +1,3 @@
-FROM ghcr.io/linkerd/dev:v26-rust
+FROM ghcr.io/linkerd/dev:v28-rust
 COPY entrypoint.sh /
 ENTRYPOINT ["/entrypoint.sh"]

.github/workflows/actions.yml

@@ -13,14 +13,14 @@ jobs:
   actionlint:
     runs-on: ubuntu-20.04
     timeout-minutes: 10
-    container: ghcr.io/linkerd/dev:v26-tools
+    container: ghcr.io/linkerd/dev:v28-tools
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-      - run: just actions-lint
+      - run: just action-lint
 
   devcontainer-versions:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-tools
+    container: ghcr.io/linkerd/dev:v28-tools
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-      - run: just actions-dev-versions
+      - run: just action-dev-check

.github/workflows/beta.yml

@@ -22,7 +22,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-rust
+    container: ghcr.io/linkerd/dev:v28-rust
     timeout-minutes: 20
     continue-on-error: true
     steps:

.github/workflows/check-all.yml

@@ -25,7 +25,7 @@ jobs:
   check-all:
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-rust
+    container: ghcr.io/linkerd/dev:v28-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch

.github/workflows/check-each.yml

@@ -49,7 +49,7 @@ jobs:
     needs: list-changed-crates
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-rust
+    container: ghcr.io/linkerd/dev:v28-rust
     strategy:
       matrix:
         crate: ${{ fromJson(needs.list-changed-crates.outputs.crates) }}

.github/workflows/coverage.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container:
-      image: docker://ghcr.io/linkerd/dev:v26-rust
+      image: docker://ghcr.io/linkerd/dev:v28-rust
       options: --security-opt seccomp=unconfined # 🤷
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b

.github/workflows/deps.yml

@@ -46,7 +46,7 @@ jobs:
   deprecated:
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-rust
+    container: ghcr.io/linkerd/dev:v28-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch

.github/workflows/integration.yml

@@ -26,7 +26,7 @@ jobs:
   test:
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-rust
+    container: ghcr.io/linkerd/dev:v28-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch

.github/workflows/lint.yml

@@ -21,7 +21,7 @@ jobs:
   clippy:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-rust
+    container: ghcr.io/linkerd/dev:v28-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch
@@ -30,7 +30,7 @@ jobs:
   fmt:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-rust
+    container: ghcr.io/linkerd/dev:v28-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just check-fmt
@@ -38,7 +38,7 @@ jobs:
   docs:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-rust
+    container: ghcr.io/linkerd/dev:v28-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch

.github/workflows/nightly.yml

@@ -22,7 +22,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-rust
+    container: ghcr.io/linkerd/dev:v28-rust
     timeout-minutes: 20
     continue-on-error: true
     steps:

.github/workflows/shellcheck.yml

@@ -6,14 +6,15 @@ permissions:
 on:
   pull_request:
     paths:
-      - '**/*.sh'
       - .github/workflows/shellcheck.yml
+      - '**/*.sh'
+      - justfile
 
 jobs:
-  markdownlint:
+  sh-lint:
     timeout-minutes: 5
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-tools
+    container: ghcr.io/linkerd/dev:v28-tools
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-      - run: just shellcheck
+      - run: just sh-lint

.github/workflows/test.yml

@@ -24,7 +24,7 @@ jobs:
   meshtls:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-rust
+    container: ghcr.io/linkerd/dev:v28-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch
@@ -42,7 +42,7 @@ jobs:
   unit:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-rust
+    container: ghcr.io/linkerd/dev:v28-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch

.github/workflows/toolchain.yml

@@ -14,7 +14,7 @@ permissions:
 jobs:
   devcontainer:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-rust
+    container: ghcr.io/linkerd/dev:v28-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: |
@@ -42,7 +42,7 @@ jobs:
 
   workflows:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v26-tools
+    container: ghcr.io/linkerd/dev:v28-tools
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - shell: bash

justfile

@@ -82,8 +82,8 @@ _test := if env_var_or_default("GITHUB_ACTIONS", "") == "true" { "test" } else {
 # Recipes
 #
 
-# Run all tests and build the proxy
+# Run all lints
-default: fetch check-fmt lint test build
+lint: sh-lint md-lint clippy doc action-lint action-dev-check
 
 # Fetch dependencies
 fetch:
@@ -96,9 +96,6 @@ fmt:
 check-fmt:
     {{ cargo }} fmt -- --check
 
-# Run all lints
-lint: shellcheck markdownlint clippy doc actions-lint actions-dev-versions
-
 check *flags:
     {{ cargo }} check --workspace --all-targets --frozen {{ flags }} {{ _fmt }}
 
@@ -184,23 +181,17 @@ docker mode='load':
         {{ if features != "" { "--build-arg PROXY_FEATURES=" + features } else { "" } }} \
         {{ if mode == 'push' { "--push" } else { "--load" } }}
 
-# Display the git history minus dependabot updates
-history *paths='.':
-    @-git log --oneline --graph --invert-grep --author="dependabot" -- {{ paths }}
-
 # Lints all shell scripts in the repo.
-shellcheck:
+sh-lint:
     #!/usr/bin/env bash
     set -euo pipefail
-    files=$(for f in $(find . -type f ! \( -path ./.git/\* -or -path \*/target/\* \)) ; do
+    files=$(while IFS= read -r f ; do
-        if [ $(file -b --mime-type $f) = text/x-shellscript ]; then
+        if [ "$(file -b --mime-type "$f")" = text/x-shellscript ]; then echo "$f"; fi
-            echo -n "$f "
+    done < <(find . -type f ! \( -path ./.git/\* -or -path \*/target/\* \)) | xargs)
-        fi
+    echo "shellcheck $files" >&2
-    done)
-    echo shellcheck $files
     shellcheck $files
 
-markdownlint:
+md-lint:
     markdownlint-cli2 '**/*.md' '!target'
 
 # Format actionlint output for Github Actions if running in CI.
@@ -209,52 +200,16 @@ _actionlint-fmt := if env_var_or_default("GITHUB_ACTIONS", "") != "true" { "" }
 }
 
 # Lints all GitHub Actions workflows
-actions-lint:
+action-lint:
     actionlint \
         {{ if _actionlint-fmt != '' { "-format '" + _actionlint-fmt + "'" } else { "" } }} \
         .github/workflows/*
 
-# Ensure all devcontainer versions are in sync
+action-dev-check:
-actions-dev-versions:
+    action-dev-check
-    #!/usr/bin/env bash
+
-    set -euo pipefail
+# Display the git history minus dependabot updates
-    IMAGE=$(json5-to-json <.devcontainer/devcontainer.json |jq -r '.image')
+history *paths='.':
-    check_image() {
+    @-git log --oneline --graph --invert-grep --author="dependabot" -- {{ paths }}
-        if [ "$1" != "$IMAGE" ]; then
-            # Report all line numbers with the unexpected image.
-            for n in $(grep -nF "$1" "$2" | cut -d: -f1) ; do
-                if [ "${GITHUB_ACTIONS:-}" = "true" ]; then
-                    echo "::error file=${2},line=${n}::Expected image '${IMAGE}'; found '${1}'">&2
-                else
-                    echo "${2}:${n}: Expected image '${IMAGE}'; found '${1}'" >&2
-                fi
-            done
-            return 1
-        fi
-    }
-    EX=0
-    # Check workflows for devcontainer images
-    for f in .github/workflows/* ; do
-        # Find all container images that look like our dev image, dropping the
-        # `-suffix` from the tag.
-        for i in $(yq '.jobs.* |  (.container | select(.) | (.image // .)) | match("ghcr.io/linkerd/dev:v[0-9]+").string' < "$f") ; do
-            if ! check_image "$i" "$f" ; then
-                EX=$((EX+1))
-                break
-            fi
-        done
-    done
-    # Check actions for devcontainer images
-    while IFS= read -r f ; do
-        for i in $(awk 'toupper($1) ~ "FROM" { print $2 }' "$f" \
-                    | sed -Ene 's,(ghcr\.io/linkerd/dev:v[0-9]+).*,\1,p')
-        do
-            if ! check_image "$i" "$f" ; then
-                EX=$((EX+1))
-                break
-            fi
-        done
-    done < <(find .github/actions -name Dockerfile\*)
-    exit $EX
 
 # vim: set ft=make :