[DEVOPS-1595] - Add supported workflows to linter workflow

.github/workflows/workflow-linter.yml

@@ -5,7 +5,7 @@ on:
   pull_request:
     paths:
       - .github/workflows/**
-  workflow_call:
+  workflow_call: {}
 
 jobs:
   lint:

lint-workflow/lint.py

@@ -209,6 +209,9 @@ def lint(filename):
     with open(filename) as file:
         workflow = yaml.load(file, Loader=yaml.FullLoader)
 
+    with open("supported-actions.json") as file:
+        supported_actions = json.load(file)
+
         # Check for 'name' key for the workflow.
         if "name" not in workflow:
             findings.append(LintFinding("Name key missing for workflow.", "warning"))
@@ -292,9 +295,24 @@ def lint(filename):
                             logging.info("Skipping local action in workflow.")
                             break
 
-                        # If the step has a 'uses' key, check value hash, except bitwarden actions.
+                        # If the step has a 'uses' key, check if actions are in supported actions list and also value hash, except bitwarden actions.
                         if "bitwarden/gh-actions" not in path:
                             try:
+                                # Check if actions are in supported actions list.
+                                actions_count = 0
+                                for action in supported_actions['supported_actions']:
+                                    if action in path:
+                                        break
+                                    else:
+                                        actions_count += 1
+
+                                if actions_count > 0:
+                                    findings.append(
+                                        LintFinding(
+                                            f"Step {str(i)} of job key '{job_key}' uses an unsupported action: {path}.",
+                                            "warning",
+                                        )
+                                    )
                                 # Check to make sure SHA1 hash is 40 characters.
                                 if len(hash) != 40:
                                     findings.append(

lint-workflow/supported-actions.json

@@ -0,0 +1 @@
+{ "supported_actions": ["act10ns/slack", "actions/cache", "actions/checkout", "actions/delete-package-versions", "actions/download-artifact", "actions/github-script", "actions/labeler", "actions/setup-dotnet", "actions/setup-java", "actions/setup-node", "actions/setup-python", "actions/stale", "actions/upload-artifact", "android-actions/setup-android", "Asana/create-app-attachment-github-action", "Azure/functions-action", "Azure/get-keyvault-secrets", "Azure/login", "azure/webapps-deploy", "bitwarden/sm-action", "checkmarx/ast-github-action", "chrnorm/deployment-action", "chrnorm/deployment-status", "chromaui/action", "cloudflare/pages-action", "convictional/trigger-workflow-and-wait", "crazy-max/ghaction-import-gpg", "crowdin/github-action", "dawidd6/action-download-artifact", "dawidd6/action-homebrew-bump-formula", "digitalocean/action-doctl", "docker/build-push-action", "docker/setup-buildx-action", "docker/setup-qemu-action", "dorny/test-reporter", "dtolnay/rust-toolchain", "futureware-tech/simulator-action", "hashicorp/setup-packer", "macauley/action-homebrew-bump-cask", "microsoft/setup-msbuild", "ncipollo/release-action", "nuget/setup-nuget", "peter-evans/close-issue", "ruby/setup-ruby", "samuelmeuli/action-snapcraft", "snapcore/action-build", "sonarsource/sonarcloud-github-action", "stackrox/kube-linter-action", "Swatinem/rust-cache", "SwiftDocOrg/github-wiki-publish-action", "SwiftDocOrg/swift-doc", "tj-actions/changed-files", "yogevbd/enforce-label-action"]}