winget-intune-win32/.github/workflows/pr-any-lint-workflows.yaml at 095abda6e8171bf588f59862bd6dc5f4ad4784cd · o-l-a-v/winget-intune-win32 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
name: Lint GitHub workflows with zizmor

run-name: "${{ github.workflow }} - [${{ github.event.pull_request.title }} #${{ github.event.pull_request.number }}] by @${{ github.actor }}"

on:
  pull_request:
    paths:
      - .github/workflows/**

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint-workflows:
    name: Run zizmor latest via PyPI
    permissions:
      contents: read
      pull-requests: read
    runs-on: ubuntu-latest
    steps:
      - name: 🛎️ GitHub checkout branch "${{ github.head_ref || github.ref_name }}"
        uses: actions/checkout@v5
        with:
          persist-credentials: false
      - name: 🔍 Get changed files
        id: filter
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        with:
          filters: |
            workflows:
              - added|modified: '.github/workflows/**'
          list-files: escape
      - name: ⬇️ Install the latest version of uv
        if: steps.filter.outputs.workflows == 'true'
        uses: astral-sh/setup-uv@557e51de59eb14aaaba2ed9621916900a91d50c6 # v6.6.0
      - name: 🔍 Run zizmor
        if: steps.filter.outputs.workflows == 'true'
        run: |
          uvx zizmor --format plain --offline --min-confidence low --min-severity low \
          ${{ steps.filter.outputs.workflows_files }}