Bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 in the github-actions group across 1 directory #26

	# SPDX-License-Identifier: Apache-2.0

	name: Lint GitHub Actions workflows
	on:
	push:
	branches:
	- "main"
	paths:
	- '.github/workflows/*.ya?ml'
	- '.github/actions/**/action.ya?ml'
	- '.github/zizmor.ya?ml'
	- '.poutine.ya?ml'
	pull_request:
	branches:
	- "main"
	paths:
	- '.github/workflows/*.ya?ml'
	- '.github/actions/**/action.ya?ml'
	- '.github/zizmor.ya?ml'
	- '.poutine.ya?ml'

	env:
	LC_ALL: en_US.UTF-8

	defaults:
	run:
	shell: bash

	permissions:
	contents: read

	jobs:
	actionlint:
	permissions:
	security-events: write # Required for upload-sarif to upload SARIF files.
	runs-on: ubuntu-latest
	steps:
	- name: "Harden Runner"
	uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
	with:
	egress-policy: block
	allowed-endpoints: >
	api.github.com:443
	ghcr.io:443
	github.com:443
	pkg-containers.githubusercontent.com:443

	- name: "Checkout"
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false

	- name: "Check workflow files with zizmor"
	uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0

	- name: "Check workflow files with poutine"
	uses: boostsecurityio/poutine-action@e240ebd3eff8b2db5a8e5f6b28f58739d7db2247 # v1.1.4
	with:
	output: ${{ runner.temp }}/poutine.sarif

	- name: "Upload poutine SARIF file"
	uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
	with:
	sarif_file: ${{ runner.temp }}/poutine.sarif
	category: poutine

Navigation Menu