check.actions-lint.ci.yml

name: "Lint: Actions"

concurrency:
    group: lint-actions-${{ github.head_ref || github.run_id }}
    cancel-in-progress: true

on:
    ## Check actions on merge queue insertion
    merge_group: {}

    ## Allow this workflow to be re-used
    workflow_call:
      inputs:
        ## Network mode to apply.
        network:
          description: "Network"
          required: false
          type: string
          default: audit

    ## Check on release
    release:
        types: [created]

    ## Check on push to `main` if modified
    push:
        branches:
            - main
        paths:
            - ".github/workflows/*.yaml"
            - ".github/workflows/*.yml"
            - ".github/workflows/pkg/*/*.yaml"
            - ".github/workflows/pkg/*/*.yml"
            - "actions/*/*.yaml"
            - "actions/*/*.yml"
            - "containers/*/*.yaml"
            - "containers/*/*.yml"

    ## Check each PR change against `main`
    pull_request:
        paths:
            - ".github/workflows/*.yaml"
            - ".github/workflows/*.yml"
            - ".github/workflows/pkg/*/*.yaml"
            - ".github/workflows/pkg/*/*.yml"
            - "actions/*/*.yaml"
            - "actions/*/*.yml"
            - "containers/*/*.yaml"
            - "containers/*/*.yml"

env:
    GO_VERSION: '>=1.19.0'

permissions:
  contents: read

jobs:
  ## Task: Lint workflows in this respository with Actions Lint
  lint-workflow-actions:
    name: "Workflows"
    runs-on: ${{ vars.RUNNER || 'ubuntu-latest' }}
    permissions:
        contents: "read"
        id-token: "write"
        checks: "write"
        pull-requests: "read"
    steps:
        - name: "Setup: Harden Runner"
          uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
          with:
            egress-policy: ${{ inputs.network || 'audit' }}
        - name: "Setup: Checkout"
          uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
          with:
            persist-credentials: false
        - name: "Setup: Go"
          uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
          with:
            go-version: ${{ vars.GO_VERSION || '' }}
        - name: "Setup: Action Linter"
          run: go install github.com/rhysd/actionlint/cmd/actionlint@latest
        - name: "Lint: Actions"
          run: actionlint