Update actions/create-github-app-token action to v3

.github/actions/lint/action.yaml

@@ -0,0 +1,60 @@
+name: Lint
+
+description: Run linters
+
+inputs:
+  github-app-client-id:
+    description: Client ID of GitHub App to use to generate token
+
+  github-app-private-key:
+    description: Private key of GitHub App to use to generate token
+
+runs:
+  using: composite
+
+  steps:
+    - name: Generate cache keys
+      id: lychee-cache
+      shell: bash
+      run: |-
+        print_key() {
+          printf "lychee-"
+          date --date="$1 days ago" +%F
+        }
+
+        {
+          printf "key="
+          print_key 0
+
+          echo "restore-keys<<EOF"
+          print_key 1
+          print_key 2
+          print_key 3
+          echo EOF
+        } >> "${GITHUB_OUTPUT}"
+
+    - name: Restore cached link checks
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      with:
+        path: .lycheecache
+        key: ${{ steps.lychee-cache.outputs.key }}
+        restore-keys: ${{ steps.lychee-cache.outputs.restore-keys }}
+
+    - name: Generate docs
+      shell: bash
+      run: pnpm run docs
+
+    - name: Generate bot token
+      uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+      id: generate-token
+      continue-on-error: true
+      with:
+        app-id: ${{ inputs.github-app-client-id }}
+        private-key: ${{ inputs.github-app-private-key }}
+        permission-metadata: read
+
+    - name: Lint code
+      shell: bash
+      run: pnpm run lint
+      env:
+        GITHUB_TOKEN: ${{ steps.generate-token.outputs.token || github.token }}

.github/workflows/cache.yaml

@@ -23,3 +23,10 @@ jobs:
         uses: ./.github/actions/setup-node
         with:
           only-scripts: ${{ matrix.only-scripts }}
+
+      - name: Lint
+        if: matrix.only-scripts == 'false'
+        uses: ./.github/actions/lint
+        with:
+          github-app-client-id: ${{ secrets.CERBOS_BOT_CLIENT_ID }}
+          github-app-private-key: ${{ secrets.CERBOS_BOT_PRIVATE_KEY }}

.github/workflows/ci.yaml

@@ -33,22 +33,11 @@ jobs:
       - name: Set up Node.js
         uses: ./.github/actions/setup-node
 
-      - name: Generate docs
-        run: pnpm run docs
-
-      - name: Generate bot token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
-        id: generate-token
-        continue-on-error: true
+      - name: Lint
+        uses: ./.github/actions/lint
         with:
-          app-id: ${{ secrets.CERBOS_BOT_CLIENT_ID }}
-          private-key: ${{ secrets.CERBOS_BOT_PRIVATE_KEY }}
-          permission-metadata: read
-
-      - name: Lint code
-        run: pnpm run lint
-        env:
-          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token || github.token }}
+          github-app-client-id: ${{ secrets.CERBOS_BOT_CLIENT_ID }}
+          github-app-private-key: ${{ secrets.CERBOS_BOT_PRIVATE_KEY }}
 
       - name: Generate code
         run: pnpm run generate

.github/workflows/update-protos.yaml

@@ -23,7 +23,7 @@ jobs:
         run: pnpm run generate
 
       - name: Generate bot token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         id: generate-token
         with:
           app-id: ${{ secrets.CERBOS_BOT_CLIENT_ID }}

.gitignore

@@ -6,4 +6,5 @@
 /private/*/node_modules/
 /private/test/servers/tmp/
 /private/test/.env
+/.lycheecache
 /tsconfig.tsbuildinfo

scripts/check-links

@@ -3,7 +3,11 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-excludes=(--exclude https://www.npmjs.com/)
+excludes=(
+  --exclude https://www.npmjs.com/
+  --exclude https://opentelemetry.io/
+)
+
 case "${GITHUB_HEAD_REF:-}" in
   "prepare-release" | "prepare-releases")
     excludes+=(--exclude https://github.com/cerbos/cerbos-sdk-javascript/compare/)
@@ -16,24 +20,42 @@ check() {
     --rm \
     --env GITHUB_TOKEN \
     --mount "type=bind,source=${PWD},target=/input" \
+    --user "${uid}:${gid}" \
     --workdir /input \
     lycheeverse/lychee:latest-alpine \
     "${excludes[@]}" \
+    --cache \
+    --cache-exclude-status 400.. \
+    --format detailed \
     --include-fragments \
     --max-concurrency 8 \
+    --max-cache-age 3d \
     --remap "^https://cerbos\.github\.io/cerbos-sdk-javascript/ file:///input/docs/" \
     --verbose \
-    "$@"
+    "$@" \
+    2> >(grep -v -E "Skipping fragment check for [^ ]+ within a plaintext file")
+}
+
+heading() {
+  printf "\n\e[34m%s\e[0m\n" "$1"
 }
 
 git_commit=$(git rev-parse HEAD)
 
 docker pull lycheeverse/lychee:latest-alpine
 
+uid=$(id -u)
+gid=$(id -g)
+touch .lycheecache
+
+heading "Checking links in repo"
+
 check \
   --root-dir /input \
   .
 
+heading "Checking links in docs"
+
 check \
   --remap "^https://github\.com/[^/]+/cerbos-sdk-javascript/blob/${git_commit}/ file:///input/" \
   docs