Add Checkton workflow

[chmeliik]

Checkton is a GitHub action that runs ShellCheck on scripts embedded in YAML files (https://github.com/chmeliik/checkton)

[chmeliik]

FYI, I've opened a proposal for Checkton to move to the tektoncd org: tektoncd/community#1156

But even before that's resolved, let's start using it already?

[chmeliik]

The output looks like this:

We could also upload the generated SARIF file to make GitHub show the warnings inline. But currently, there is an annoying bug (or feature?) where the warnings never go away even if you fix them - https://github.com/orgs/community/discussions/132787.

[chmeliik]

/retest

[chmeliik]

/retest

[chmeliik]

Tests timed out while waiting for the enterprise-contract pipeline to pass

Tekton was very lazy today, just refusing to schedule any steps. Even the Tekton built-in ones

[verify-enterprise-contract : prepare] 2024/07/23 11:36:28 Entrypoint initialization

[verify-enterprise-contract : place-scripts] 2024/07/23 12:04:28 Decoded script /tekton/scripts/script-1-dfsnc

[verify-enterprise-contract : validate] time="2024-07-23T12:16:24Z"

[chmeliik]

/retest

[tkdchen]

It doesn't need to run the Konflux pipeline when changes are made to .github/ and hack/.

[chmeliik]

Rebased on main

It doesn't need to run the Konflux pipeline when changes are made to .github/ and hack/.

True, but we can't merge without it. I'll see if we can make it not run when those are the only two dirs that changed. There was an attempt to do this by enumerating all the directories for which we do want to run the pipeline (#524), but that seemed very fragile.

[chmeliik]

It doesn't need to run the Konflux pipeline when changes are made to .github/ and hack/.

True, but we can't merge without it. I'll see if we can make it not run when those are the only two dirs that changed. There was an attempt to do this by enumerating all the directories for which we do want to run the pipeline (#524), but that seemed very fragile.

And IMO we do need to run the pipeline on changes to hack/*, because the pipeline uses some hack/ scripts

[tkdchen]

And IMO we do need to run the pipeline on changes to hack/*, because the pipeline uses some hack/ scripts

Yes. 👍