dotfiles/.github/workflows/github-actions.yaml at master · 4evy/dotfiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
name: GitHub Actions

on:
  pull_request:
    paths: &workflow-paths
      - .github/actions/**
      - .github/scripts/**
      - .github/workflows/**
  push:
    branches:
      - master
    paths: *workflow-paths
  workflow_dispatch: null

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true

permissions:
  contents: read # needed to checkout and audit repository workflows

jobs:
  validate:
    name: Validate Workflows
    # Immutable GitHub bot IDs: Renovate, GitHub Actions, Dependabot.
    if: >-
      github.event_name != 'pull_request' ||
      contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association) ||
      (github.event.pull_request.user.type == 'Bot' &&
      contains(fromJSON('[29139614, 41898282, 49699333]'), github.event.pull_request.user.id))
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout Repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Run actionlint
        uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
        with:
          version: "1.7.12"

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
        with:
          advanced-security: false
          annotations: true
          persona: pedantic
          version: "1.28.0"

      - name: Verify Immutable Action Pins
        env:
          GH_TOKEN: ${{ github.token }}
        run: bash .github/scripts/verify-action-pins.sh