Carlos Florêncio
48 lines
1.3 KiB
YAML
48 lines
1.3 KiB
YAML
name: Lint Action Pinning
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- ".github/workflows/**"
|
|
- ".github/scripts/lint-action-pinning.py"
|
|
- ".github/scripts/lint-action-pinning_test.py"
|
|
- ".github/scripts/collect-macos-desktop-diagnostics.sh"
|
|
- ".github/scripts/release-workflow-contract_test.py"
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- ".github/workflows/**"
|
|
- ".github/scripts/lint-action-pinning.py"
|
|
- ".github/scripts/lint-action-pinning_test.py"
|
|
- ".github/scripts/collect-macos-desktop-diagnostics.sh"
|
|
- ".github/scripts/release-workflow-contract_test.py"
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# Least-privilege: only reads source.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint:
|
|
name: All action refs are SHA-pinned
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Test action-pinning lint
|
|
run: python3 .github/scripts/lint-action-pinning_test.py
|
|
|
|
- name: Test release workflow contract
|
|
run: python3 .github/scripts/release-workflow-contract_test.py
|
|
|
|
- name: Verify action refs
|
|
run: python3 .github/scripts/lint-action-pinning.py
|