CI: Validate Flatpak with flatpak-builder-lint

Validate the Flatpak manifest before building it; then, validate
the build directory; and when publishing, validate the repository
as well.

Using flatpak-builder-lint in the org.flatpak.Builder Flatpak in a
docker container seems to not work.

So the linter repo is cloned and Poetry is used to run it inside an
custom action.

"--exceptions" is required to allow the manifest to pass since
OBS Studio has one for "--talk-name=org.freedesktop.Flatpak".

Co-authored-by: Georges Basile Stavracas Neto <[email protected]>
(cherry picked from commit 9f8655921fb8c8459d1bee73051d4e70f58abc63)

.github/actions/flatpak-builder-lint/action.yaml

@@ -0,0 +1,73 @@
+name: Run flatpak-builder-lint
+description: Runs flatpak-builder-lint with exceptions
+inputs:
+  artifact:
+    description: Type of artifact to lint (builddir, repo, manifest)
+    required: true
+  path:
+    description: Path to flatpak-builder manifest or Flatpak build directory
+    required: true
+  workingDirectory:
+    description: Working directory to clone flatpak-builder-lint
+    required: false
+    default: ${{ github.workspace }}
+runs:
+  using: composite
+  steps:
+    - name: Check artifact type
+      shell: bash
+      working-directory: ${{ inputs.workingDirectory }}
+      run: |
+        : Check artifact input
+        case "${{ inputs.artifact }}" in
+          builddir);;
+          repo);;
+          manifest);;
+          *)
+            echo "::error::Given artifact type is incorrect"
+            exit 2
+            ;;
+        esac
+
+    - uses: actions/checkout@v3
+      with:
+        repository: flathub/flatpak-builder-lint
+        ref: v2.0.13
+        path: flatpak-builder-lint
+        set-safe-directory: ${{ inputs.workingDirectory }}
+
+    - name: Install Dependencies 🛍️
+      shell: bash
+      working-directory: ${{ inputs.workingDirectory }}
+      run: |
+        : Install Dependencies 🛍️
+        echo ::group::Install Dependencies
+        dnf install -y -q poetry jq
+        poetry -q -C flatpak-builder-lint install
+        echo ::endgroup::
+
+    - name: Run flatpak-builder-lint
+      id: result
+      shell: bash
+      working-directory: ${{ inputs.workingDirectory }}
+      run: |
+        : Run flatpak-builder-lint
+        exit_code=0
+        ret=$(poetry -C flatpak-builder-lint run flatpak-builder-lint --exceptions ${{ inputs.artifact }} ${{ inputs.path }}) || exit_code=$?
+        if [[ $exit_code != 0 && -z "$ret" ]]; then
+          echo "::error::Error while running flatpak-builder-lint"
+          exit 2
+        fi
+
+        for ((i = 0 ; i < $(echo $ret | jq '.warnings | length') ; i++)); do
+          warning=$(echo $ret | jq ".warnings[$i]")
+          echo "::warning::$warning found in the Flatpak ${{ inputs.artifact }}"
+        done
+
+        n_errors=$(echo $ret | jq '.errors | length')
+        for ((i = 0; i < $n_errors; i++)); do
+          error=$(echo $ret | jq ".errors[$i]")
+          echo "::error::$error found in the Flatpak ${{ inputs.artifact }}"
+        done
+
+        [[ $n_errors == 0 ]] || exit 2

.github/workflows/build-project.yaml

@@ -286,6 +286,12 @@ jobs:
 
           echo "cacheKey=${cache_key}" >> $GITHUB_OUTPUT
 
+      - name: Validate Flatpak manifest
+        uses: ./.github/actions/flatpak-builder-lint
+        with:
+          artifact: manifest
+          path: build-aux/com.obsproject.Studio.json
+
       - name: Build Flatpak Manifest 🧾
         uses: flatpak/flatpak-github-actions/flatpak-builder@0ab9dd6a6afa6fe7e292db0325171660bf5b6fdf
         with:
@@ -296,6 +302,12 @@ jobs:
           restore-cache: ${{ fromJSON(steps.setup.outputs.cacheHit) }}
           cache-key: ${{ steps.setup.outputs.cacheKey }}
 
+      - name: Validate build directory
+        uses: ./.github/actions/flatpak-builder-lint
+        with:
+          artifact: builddir
+          path: flatpak_app
+
   windows-build:
     name: Windows 🪟
     runs-on: windows-2022

.github/workflows/publish.yaml

@@ -98,6 +98,12 @@ jobs:
           echo "cacheKey=${cache_key}" >> $GITHUB_OUTPUT
           echo "commitHash=${GITHUB_SHA:0:9}" >> $GITHUB_OUTPUT
 
+      - name: Validate Flatpak manifest
+        uses: ./.github/actions/flatpak-builder-lint
+        with:
+          artifact: manifest
+          path: build-aux/com.obsproject.Studio.json
+
       - name: Build Flatpak Manifest
         uses: flatpak/flatpak-github-actions/flatpak-builder@0ab9dd6a6afa6fe7e292db0325171660bf5b6fdf
         with:
@@ -126,6 +132,18 @@ jobs:
           : Commit Screenshots to OSTree Repository
           ostree commit --repo=repo --canonical-permissions --branch=screenshots/x86_64 flatpak_app/screenshots
 
+      - name: Validate build directory
+        uses: ./.github/actions/flatpak-builder-lint
+        with:
+          artifact: builddir
+          path: flatpak_app
+
+      - name: Validate repository
+        uses: ./.github/actions/flatpak-builder-lint
+        with:
+          artifact: repo
+          path: repo
+
       - name: Publish to Flathub Beta
         uses: flatpak/flatpak-github-actions/flat-manager@0ab9dd6a6afa6fe7e292db0325171660bf5b6fdf
         if: ${{ matrix.branch == 'beta' }}