Bump the github-actions group across 1 directory with 3 updates #35

	# SPDX-License-Identifier: Apache-2.0

	name: Lint GitHub Actions workflows
	on:
	push:
	branches:
	- "main"
	paths:
	- '.github/workflows/*.ya?ml'
	- '.github/actions/**/action.ya?ml'
	- '.github/zizmor.ya?ml'
	- '.poutine.ya?ml'
	pull_request:
	branches:
	- "main"
	paths:
	- '.github/workflows/*.ya?ml'
	- '.github/actions/**/action.ya?ml'
	- '.github/zizmor.ya?ml'
	- '.poutine.ya?ml'

	env:
	LC_ALL: en_US.UTF-8

	defaults:
	run:
	shell: bash

	permissions:
	contents: read

	jobs:
	actionlint:
	permissions:
	security-events: write # Required for upload-sarif to upload SARIF files.
	runs-on: ubuntu-latest
	steps:
	- name: "Harden Runner"
	uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
	with:
	egress-policy: block
	allowed-endpoints: >
	api.github.com:443
	ghcr.io:443
	github.com:443
	pkg-containers.githubusercontent.com:443

	- name: "Checkout"
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: "Check workflow files with zizmor"
	uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2

	- name: "Check workflow files with poutine"
	uses: boostsecurityio/poutine-action@e240ebd3eff8b2db5a8e5f6b28f58739d7db2247 # v1.1.4
	with:
	output: ${{ runner.temp }}/poutine.sarif

	- name: "Upload poutine SARIF file"
	uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
	with:
	sarif_file: ${{ runner.temp }}/poutine.sarif
	category: poutine

Navigation Menu