pr-any-lint-workflows.yaml

name: Lint GitHub workflows with zizmor

run-name: "${{ github.workflow }} - [${{ github.event.pull_request.title }} #${{ github.event.pull_request.number }}] by @${{ github.actor }}"

on:
  pull_request:
    paths:
      - .github/workflows/**

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint-workflows:
    name: Run zizmor latest via PyPI
    permissions:
      contents: read
      pull-requests: read
    runs-on: ubuntu-slim
    steps:
      - name: 🛎️ GitHub checkout branch "${{ github.head_ref || github.ref_name }}"
        uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: 🔍 Get changed files
        id: filter
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        with:
          filters: |
            workflows:
              - added|modified: '.github/workflows/**'
          list-files: escape
      - name: ⬇️ Install the latest version of uv
        if: steps.filter.outputs.workflows == 'true'
        uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
        with:
          cache-dependency-glob: ""
          enable-cache: true
      - name: 🔍 Run zizmor
        if: steps.filter.outputs.workflows == 'true'
        run: |
          uvx zizmor --format plain --offline --min-confidence low --min-severity low \
          --config ./.config/zizmor.yml \
          ${{ steps.filter.outputs.workflows_files }}