cli/.github/workflows/validate.yml

name: validate

# Default to 'contents: read', which grants actions to read commits.
#
# If any permission is set, any permission not included in the list is
# implicitly set to "none".
#
# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  workflow_dispatch:
  push:
    branches:
      - 'master'
      - '[0-9]+.[0-9]+'
      - '[0-9]+.x'
    tags:
      - 'v*'
  pull_request:

jobs:
  validate:
    runs-on: ubuntu-26.04
    strategy:
      fail-fast: false
      matrix:
        target:
          - lint
          - shellcheck
          - validate-vendor
          - update-authors # ensure authors update target runs fine
    steps:
      - name: Configure credentials
        continue-on-error: true
        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
        with:
          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
          profile: administrator
          profile-region: us-east-1
      -
        name: Run
        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
        with:
          targets: ${{ matrix.target }}

  # check that the generated Markdown and the checked-in files match
  validate-md:
    runs-on: ubuntu-26.04
    steps:
      - name: Configure credentials
        continue-on-error: true
        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
        with:
          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
          profile: administrator
          profile-region: us-east-1
      -
        name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      -
        name: Generate
        shell: 'script --return --quiet --command "bash {0}"'
        run: |
          make -f docker.Makefile mddocs
      -
        name: Validate
        run: |
          if [[ $(git diff --stat) != '' ]]; then
            echo 'fail: generated files do not match checked-in files'
            git --no-pager diff
            exit 1
          fi

  validate-make:
    runs-on: ubuntu-26.04
    strategy:
      fail-fast: false
      matrix:
        target:
          - yamldocs # ensure yamldocs target runs fine
          - manpages # ensure manpages target runs fine
    steps:
      - name: Configure credentials
        continue-on-error: true
        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
        with:
          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
          profile: administrator
          profile-region: us-east-1
      -
        name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      -
        name: Run
        shell: 'script --return --quiet --command "bash {0}"'
        run: |
          make -f docker.Makefile ${{ matrix.target }}

  validate-gocompat:
    runs-on: ubuntu-26.04
    env:
      GOPATH: ${{ github.workspace }}
      GO111MODULE: off
    steps:
      - name: Configure credentials
        continue-on-error: true
        uses: tracebit-com/tracebit-community-action@27de2ed8de16af5270d32003a4c8bfc3c54e0a20 # v1.2.0
        with:
          customer-id: ${{ secrets.TRACEBIT_CUSTOMER_ID }}
          api-token: ${{ secrets.TRACEBIT_API_TOKEN }}
          profile: administrator
          profile-region: us-east-1
      -
        name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          path: src/github.com/docker/cli
          persist-credentials: false
      -
        name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26.8"
          cache: false
      -
        name: Run gocompat check
        shell: 'script --return --quiet --command "bash {0}"'
        working-directory: ${{ github.workspace }}/src/github.com/docker/cli
        run: |
          make -C ./internal/gocompat verify