feat: add a policy action_shell_is_required (#281)

README.md

@@ -33,6 +33,7 @@ ghalint is a command line tool to check GitHub Actions Workflows anc action.yaml
 1. [action_ref_should_be_full_length_commit_sha](docs/policies/008.md): action's ref should be full length commit SHA
 1. [github_app_should_limit_repositories](docs/policies/009.md): GitHub Actions issueing GitHub Access tokens from GitHub Apps should limit repositories
 1. [github_app_should_limit_permissions](docs/policies/010.md): GitHub Actions issueing GitHub Access tokens from GitHub Apps should limit permissions
+1. [action_shell_is_required](docs/policies/011.md): `shell` is required if `run` is set
 
 ## How to install
 

docs/policies/011.md

@@ -0,0 +1,24 @@
+# action_shell_is_required
+
+`shell` is required if `run` is set
+
+## Examples
+
+:x:
+
+```yaml
+- run: echo hello
+```
+
+⭕
+
+```yaml
+- run: echo hello
+  shell: bash
+```
+
+## Why?
+
+> Required if run is set.
+
+https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsshell

pkg/controller/act/run.go

@@ -27,6 +27,7 @@ func (c *Controller) Run(_ context.Context, logE *logrus.Entry, cfgFilePath stri
 	stepPolicies := []controller.StepPolicy{
 		&policy.GitHubAppShouldLimitRepositoriesPolicy{},
 		&policy.GitHubAppShouldLimitPermissionsPolicy{},
+		&policy.ActionShellIsRequiredPolicy{},
 		policy.NewActionRefShouldBeSHA1Policy(),
 	}
 	failed := false

pkg/policy/action_shell_is_required.go

@@ -0,0 +1,26 @@
+package policy
+
+import (
+	"errors"
+
+	"github.com/sirupsen/logrus"
+	"github.com/suzuki-shunsuke/ghalint/pkg/config"
+	"github.com/suzuki-shunsuke/ghalint/pkg/workflow"
+)
+
+type ActionShellIsRequiredPolicy struct{}
+
+func (p *ActionShellIsRequiredPolicy) Name() string {
+	return "action_shell_is_required"
+}
+
+func (p *ActionShellIsRequiredPolicy) ID() string {
+	return "011"
+}
+
+func (p *ActionShellIsRequiredPolicy) ApplyStep(_ *logrus.Entry, _ *config.Config, _ *StepContext, step *workflow.Step) error {
+	if step.Run != "" && step.Shell == "" {
+		return errors.New("shell is required if run is set")
+	}
+	return nil
+}

pkg/policy/action_shell_is_required_test.go

@@ -0,0 +1,50 @@
+package policy_test
+
+import (
+	"testing"
+
+	"github.com/sirupsen/logrus"
+	"github.com/suzuki-shunsuke/ghalint/pkg/policy"
+	"github.com/suzuki-shunsuke/ghalint/pkg/workflow"
+)
+
+func TestActionShellIsRequiredPolicy_ApplyStep(t *testing.T) {
+	t.Parallel()
+	data := []struct {
+		name  string
+		step  *workflow.Step
+		isErr bool
+	}{
+		{
+			name: "pass",
+			step: &workflow.Step{
+				Run:   "echo hello",
+				Shell: "bash",
+			},
+		},
+		{
+			name:  "step error",
+			isErr: true,
+			step: &workflow.Step{
+				Run: "echo hello",
+			},
+		},
+	}
+	p := &policy.ActionShellIsRequiredPolicy{}
+	logE := logrus.NewEntry(logrus.New())
+	for _, d := range data {
+		d := d
+		t.Run(d.name, func(t *testing.T) {
+			t.Parallel()
+			if err := p.ApplyStep(logE, nil, nil, d.step); err != nil {
+				if d.isErr {
+					return
+				}
+				t.Fatal(err)
+			}
+			if d.isErr {
+				t.Fatal("error must be returned")
+			}
+		})
+	}
+}

pkg/workflow/workflow.go

@@ -17,10 +17,12 @@ type Job struct {
 }
 
 type Step struct {
-	Uses string
-	ID   string
-	Name string
-	With map[string]string
+	Uses  string
+	ID    string
+	Name  string
+	Run   string
+	Shell string
+	With  map[string]string
 }
 
 type Action struct {

test-action.yaml

@@ -50,3 +50,6 @@ runs:
       with:
         app-id: ${{vars.APP_ID}}
         private-key: ${{secrets.PRIVATE_KEY}}
+
+    - run: echo hello
+      # action_shell_is_required