action.yaml

name: Trunk Check
author: trunk.io
description: The official trunk.io GitHub action

branding:
  icon: check
  color: green

inputs:
  trunk-path:
    description:
      Path to Trunk Launcher. If not provided, we'll look for it the repo root, `.trunk/bin` and
      `tools/`. If it can't be found anywhere and is not provided explicitly, we'll download it on
      demand.
    required: false

  label:
    description:
      Label to append to the check run name (useful if running Trunk Check on multiple platforms)
    deprecationMessage: "Use `arguments: --github-label=value` instead."
    required: false

  arguments:
    description: Extra arguments to pass to trunk
    required: false

  check-mode:
    description:
      Trunk check mode. Leave unset to autodetect. Set to 'all' to check the entire repository. Set
      to 'populate_cache_only' in a dedicated workflow to populate the GitHub Actions cache with
      Trunk artifacts (see docs for more details).
    required: false

  check-all-mode:
    description:
      If set to "hold-the-line", computes new/existing issues by comparing to previous upload.
    required: false
    default: ""

  check-run-id:
    description: Check run ID. If set, posts annotations using CheckService.
    required: false

  cache:
    description:
      Cache trunk downloads and results between runs. Caching is only needed when using ephemeral CI
      runners.
    required: false
    default: "true"

  cache-key:
    description:
      A key unique to the repo/branch this action is being run on (e.g. the repo name and branch)
    required: false

  post-init:
    description: Steps to run after auto-init / before check
    required: false

  github-token:
    description: For overriding github.token
    required: false

  trunk-token:
    description:
      You can find a per-repo API token in the Trunk web app settings. This will cause results to be
      uploaded to the Trunk web app if this job is a scheduled job running on a branch, or if
      `check-mode` is set to 'all'.
    required: false

  upload-series:
    description:
      Upload series name, for when `trunk-token` is provided. If not provided, we'll use the branch
      name.
    required: false

  save-annotations:
    description:
      Save annotations as an artifact instead of posting them from this action. This is neccesary if
      your repository will be used with forks as they will will not have permissions to upload
      annotations. By default forks will be auto-detected.
    required: false
    default: auto

  post-annotations:
    description:
      Post annotations previously uploaded with the `save-annotations` option (specific to posting
      annotations from forks).
    required: false
    default: "false"

  setup-deps:
    description:
      Install dependencies for trunk check that the trunk CLI does not manage. This is only
      necessary if you have Node dependencies in your package.json that your Node linters need (e.g.
      eslint dependencies, or @types packages).
    required: false
    default: "false"

  debug:
    description: Internal use only
    required: false
    default: "false"

  timeout-seconds:
    description:
      Timeout seconds before we kill the long running trunk check process via unix timeout command.
      Default setting of 0 seconds disables the timeout.
    required: false
    default: 0

  cat-trunk-debug-logs:
    description: Option to cat .trunk/logs/cli.log && .trunk/logs/daemon.log
    required: false
    default: false

  lfs-checkout:
    description: Option to checkout LFS files
    required: false
    default: true

runs:
  using: composite
  steps:
    - name: Set up inputs
      shell: bash
      run: |
        cat >>$GITHUB_ENV <<EOF
        GITHUB_TOKEN=${{ github.token }}
        TRUNK_LAUNCHER_QUIET=false
        EOF

        # First arg is field to fetch, second arg is default value or empty
        payload() {
          if [ $# -lt 2 ]; then
            DEFAULT_VALUE=empty
          else
            DEFAULT_VALUE=\"$2\"
          fi
          if command -v jq >/dev/null; then
            jq -r ".inputs.payload | fromjson | .$1 // ${DEFAULT_VALUE}" ${TEST_GITHUB_EVENT_PATH:-${GITHUB_EVENT_PATH}}
          else
            echo "::error::jq not installed on system!"
            exit 1
          fi
        }

        # Every inputs.field should be referenced as INPUT_FIELD later in the action. This allows
        # the field to be set either as an argument to the github action or via inputs.json.
        if [[ "${{ inputs.check-mode }}" == "payload" ]]; then

          INPUT_GITHUB_TOKEN=$(payload githubToken)
          INPUT_TRUNK_TOKEN=$(payload trunkToken)
          echo "::add-mask::${INPUT_GITHUB_TOKEN}"
          echo "::add-mask::${INPUT_TRUNK_TOKEN}"

          cat >>$GITHUB_ENV <<EOF
        INPUT_GITHUB_TOKEN=${INPUT_GITHUB_TOKEN}
        INPUT_TRUNK_TOKEN=${INPUT_TRUNK_TOKEN}
        TRUNK_TOKEN=${INPUT_TRUNK_TOKEN}

        TRUNK_API_ADDRESS=$(payload trunkApiAddress)

        GITHUB_EVENT_PULL_REQUEST_BASE_REPO_OWNER=$(payload pullRequest.base.repo.owner.login)
        GITHUB_EVENT_PULL_REQUEST_BASE_REPO_NAME=$(payload pullRequest.base.repo.name)
        GITHUB_EVENT_PULL_REQUEST_BASE_SHA=$(payload pullRequest.base.sha)
        GITHUB_EVENT_PULL_REQUEST_HEAD_REPO_FORK=$(payload pullRequest.head.repo.fork)
        GITHUB_EVENT_PULL_REQUEST_HEAD_SHA=$(payload pullRequest.head.sha)
        GITHUB_EVENT_PULL_REQUEST_NUMBER=$(payload pullRequest.number)
        INPUT_ARGUMENTS=$(payload arguments)
        INPUT_CACHE=$(payload cache)
        INPUT_CACHE_KEY=$(payload cacheKey)
        INPUT_CACHE_PATH=$(payload cachePath)
        INPUT_CHECK_ALL_MODE=$(payload checkAllMode)
        INPUT_CHECK_MODE=$(payload checkMode)
        INPUT_CHECK_RUN_ID=$(payload checkRunId)
        INPUT_DEBUG=$(payload debug)
        INPUT_GITHUB_REF_NAME=$(payload targetRefName)
        INPUT_LABEL=$(payload label)
        INPUT_SETUP_CACHE_KEY=$(payload setupCacheKey)
        INPUT_SETUP_DEPS=$(payload setupDeps)
        INPUT_TARGET_CHECKOUT=$(payload targetCheckout)
        INPUT_TARGET_CHECKOUT_REF=$(payload targetCheckoutRef)
        INPUT_TRUNK_PATH=$(payload trunkPath)
        INPUT_UPLOAD_LANDING_STATE=$(payload uploadLandingState)
        INPUT_UPLOAD_SERIES=$(payload uploadSeries)
        INPUT_UPLOAD_ID=$(payload uploadId)
        INPUT_AUTOFIX_AND_PUSH=$(payload autofixAndPush)
        INPUT_LFS_CHECKOUT=$(payload lfsCheckout true)
        EOF

        else

          cat >>$GITHUB_ENV <<EOF
        INPUT_GITHUB_TOKEN=${{ inputs.github-token }}
        INPUT_TRUNK_TOKEN=${{ inputs.trunk-token }}
        TRUNK_TOKEN=${{ inputs.trunk-token }}
        GITHUB_EVENT_PULL_REQUEST_BASE_SHA=${{ github.event.pull_request.base.sha }}
        GITHUB_EVENT_PULL_REQUEST_HEAD_REPO_FORK=${{ github.event.pull_request.head.repo.fork }}
        GITHUB_EVENT_PULL_REQUEST_HEAD_SHA=${{ github.event.pull_request.head.sha }}
        GITHUB_EVENT_PULL_REQUEST_NUMBER=${{ github.event.pull_request.number }}
        GITHUB_REF_NAME=${{ github.ref_name }}
        INPUT_ARGUMENTS=${{ inputs.arguments }}
        INPUT_CACHE=${{ inputs.cache }}
        INPUT_CACHE_KEY=trunk-${{ inputs.cache-key }}-${{ runner.os }}-${{ hashFiles('.trunk/trunk.yaml') }}
        INPUT_CACHE_PATH=~/.cache/trunk
        INPUT_CAT_TRUNK_DEBUG_LOGS=${{ inputs.cat-trunk-debug-logs }}
        INPUT_CHECK_ALL_MODE=${{ inputs.check-all-mode }}
        INPUT_CHECK_MODE=${{ inputs.check-mode }}
        INPUT_CHECK_RUN_ID=${{ inputs.check-run-id }}
        INPUT_DEBUG=${{ inputs.debug }}
        INPUT_GITHUB_REF_NAME=${{ github.ref_name }}
        INPUT_LABEL=${{ inputs.label }}
        INPUT_SETUP_CACHE_KEY=${{ inputs.cache-key }}
        INPUT_SETUP_DEPS=${{ inputs.setup-deps }}
        INPUT_TARGET_CHECKOUT=
        INPUT_TARGET_CHECKOUT_REF=
        INPUT_TIMEOUT_SECONDS=${{ inputs.timeout-seconds }}
        INPUT_TRUNK_PATH=${{ inputs.trunk-path }}
        INPUT_UPLOAD_LANDING_STATE=false
        INPUT_UPLOAD_SERIES=${{ inputs.upload-series }}
        INPUT_UPLOAD_ID=
        INPUT_AUTOFIX_AND_PUSH=
        INPUT_LFS_CHECKOUT=${{ inputs.lfs-checkout }}
        EOF

        fi

    - name: Checkout
      if: env.INPUT_TARGET_CHECKOUT
      uses: actions/checkout@v4
      with:
        lfs: ${{ env.INPUT_LFS_CHECKOUT && inputs.lfs-checkout }}
        submodules: recursive
        repository: ${{ env.INPUT_TARGET_CHECKOUT }}
        ref: ${{ env.INPUT_TARGET_CHECKOUT_REF }}
        token: ${{ env.INPUT_GITHUB_TOKEN }}

    - name: Locate trunk
      shell: bash
      run: ${GITHUB_ACTION_PATH}/setup/locate_trunk.sh

    - name: Determine check mode
      shell: bash
      run: |
        # Determine check mode
        ${GITHUB_ACTION_PATH}/determine_check_mode.sh

    - name: Init on-demand
      shell: bash
      run: |
        if [[ ! -e .trunk/trunk.yaml ]]; then
          ${TRUNK_PATH:-trunk} --ci init
          echo "INITIALIZED_TRUNK=true" >>$GITHUB_ENV
        fi

    - name: Detect setup strategy
      shell: bash
      run: |
        if [[ -e .trunk/setup-ci ]]; then
          echo "INPUT_SETUP_DEPS=true" >>$GITHUB_ENV
        else
          mkdir -p .trunk
          ln -s ${{ github.action_path }}/setup-env .trunk/setup-ci
          echo .trunk/setup-ci >>.git/info/exclude
        fi

    - name: Set up env
      uses: ./.trunk/setup-ci
      if: env.INPUT_SETUP_DEPS == 'true'
      with:
        cache-key: ${{ env.INPUT_SETUP_CACHE_KEY }}

    - name: Post-init steps
      if: inputs.post-init
      shell: bash
      run: ${{ inputs.post-init }}

    - name: Cache Linters/Formatters
      if: env.TRUNK_CHECK_MODE != 'none' && env.INPUT_CACHE == 'true'
      uses: actions/cache@v4
      with:
        path: ${{ env.INPUT_CACHE_PATH }}
        key: ${{ env.INPUT_CACHE_KEY }}

    - name: Run trunk check on pull request
      if: env.TRUNK_CHECK_MODE == 'pull_request'
      shell: bash
      run: |
        # Run 'trunk check' on pull request
        if [[ "${{ inputs.timeout-seconds }}" != "0" ]]; then
          timeout ${{ inputs.timeout-seconds }} ${GITHUB_ACTION_PATH}/pull_request.sh
        else
          ${GITHUB_ACTION_PATH}/pull_request.sh
        fi
      env:
        INPUT_SAVE_ANNOTATIONS: ${{ inputs.save-annotations }}

    - name: Run trunk check on push
      if: env.TRUNK_CHECK_MODE == 'push'
      shell: bash
      run: |
        # Run 'trunk check' on push
        if [[ "${{ inputs.timeout-seconds }}" != "0" ]]; then
          timeout ${{ inputs.timeout-seconds }} ${GITHUB_ACTION_PATH}/push.sh
        else
          ${GITHUB_ACTION_PATH}/push.sh
        fi
      env:
        GITHUB_EVENT_AFTER: ${{ env.GITHUB_EVENT_AFTER || github.event.after }}
        GITHUB_EVENT_BEFORE: ${{ env.GITHUB_EVENT_BEFORE || github.event.before }}

    - name: Run trunk check on all
      if: env.TRUNK_CHECK_MODE == 'all'
      shell: bash
      run: |
        # Run 'trunk check' on all
        if [[ "${{ inputs.timeout-seconds }}" != "0" ]]; then
          timeout ${{ inputs.timeout-seconds }} ${GITHUB_ACTION_PATH}/all.sh
        else
          ${GITHUB_ACTION_PATH}/all.sh
        fi

    - name: Run trunk check on Trunk Merge
      if: env.TRUNK_CHECK_MODE == 'trunk_merge'
      shell: bash
      run: |
        # Run 'trunk check' on Trunk Merge
        if [[ "${{ inputs.timeout-seconds }}" != "0" ]]; then
          timeout ${{ inputs.timeout-seconds }} ${GITHUB_ACTION_PATH}/trunk_merge.sh
        else
          ${GITHUB_ACTION_PATH}/trunk_merge.sh
        fi

    - name: Cat Trunk Cli / Daemon logs
      if: always() && inputs.cat-trunk-debug-logs == 'true'
      shell: bash
      run: |
        echo "::group::.trunk/logs/cli.log"
        if [[ -f .trunk/logs/cli.log ]]; then
          cat .trunk/logs/cli.log
        else
          echo ".trunk/logs/cli.log doesn't exist"
        fi
        echo "::endgroup::"

        echo "::group::.trunk/logs/daemon.log"
        if [[ -f .trunk/logs/daemon.log ]]; then
          cat .trunk/logs/daemon.log
        else
          echo ".trunk/logs/daemon.log doesn't exist"
        fi
        echo "::endgroup::"

    - name: Run trunk install to populate the GitHub Actions cache
      if: env.TRUNK_CHECK_MODE == 'populate_cache_only'
      shell: bash
      run: |
        # Run 'trunk install' to populate the GitHub Actions cache
        ${GITHUB_ACTION_PATH}/populate_cache_only.sh

    - name: Upload annotations artifact
      if: always() && env.TRUNK_UPLOAD_ANNOTATIONS == 'true'
      uses: actions/upload-artifact@v4
      with:
        name: trunk-annotations
        overwrite: true
        path: ${{ env.TRUNK_TMPDIR }}/annotations.bin

    - name: Download annotations artifact
      if: inputs.post-annotations == 'true'
      uses: actions/github-script@v7
      with:
        # TODO(chris): We can't use the official download artifact action yet: https://github.com/actions/download-artifact/issues/172
        script: |
          let artifacts = await github.rest.actions.listWorkflowRunArtifacts({
              owner: context.repo.owner,
              repo: context.repo.repo,
              run_id: ${{ github.event.workflow_run.id }},
          });
          let matchArtifact = artifacts.data.artifacts.filter((artifact) => {
            return artifact.name == "trunk-annotations"
          })[0];
          if (matchArtifact) {
            let download = await github.rest.actions.downloadArtifact({
                owner: context.repo.owner,
                repo: context.repo.repo,
                artifact_id: matchArtifact.id,
                archive_format: 'zip',
            });
            let fs = require('fs');
            fs.writeFileSync('${{ env.TRUNK_TMPDIR }}/annotations.zip', Buffer.from(download.data));
          }

    - name: Unpack annotations artifact
      if: inputs.post-annotations == 'true'
      run: |
        # Unpack annotations artifact
        cd ${{ env.TRUNK_TMPDIR }} && unzip annotations.zip
      shell: bash

    - name: Post annotations
      if: inputs.post-annotations == 'true'
      shell: bash
      run: |
        # Post annotations
        ${GITHUB_ACTION_PATH}/annotate.sh
      env:
        GITHUB_EVENT_WORKFLOW_RUN_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}

    - name: Upload landing state
      if: env.INPUT_UPLOAD_LANDING_STATE == 'true'
      continue-on-error: true
      uses: actions/upload-artifact@v4
      with:
        name: landing-state.json
        path: .trunk/landing-state.json
        overwrite: true
        if-no-files-found: warn

    - name: Cleanup temporary files
      if: always()
      shell: bash
      run: |
        # Cleanup temporary files
        ${GITHUB_ACTION_PATH}/cleanup.sh