check.yaml-lint.ci.yml

name: "Lint: YAML"

concurrency:
    group: lint-yaml-${{ github.head_ref || github.run_id }}
    cancel-in-progress: true
  
on:
    ## Check YAML on merge queue insertion
    merge_group: {}

    ## Check on release
    release:
        types: [created]

    ## Allow this workflow to be reused.
    workflow_call:
      inputs:
        network:
          description: "Network"
          required: false
          type: string
          default: audit

    ## Check on push to `main` if modified
    push:
        branches:
            - main
        paths:
            - ".github/workflows/*.yaml"
            - ".github/workflows/*.yml"
            - "workflows/*/*.yaml"
            - "workflows/*/*.yml"
            - "actions/*/*.yaml"
            - "actions/*/*.yml"
            - "containers/*/*.yaml"
            - "containers/*/*.yml"

    ## Check each PR change against `main`
    pull_request:
        paths:
            - ".github/workflows/*.yaml"
            - ".github/workflows/*.yml"
            - "workflows/*/*.yaml"
            - "workflows/*/*.yml"
            - "actions/*/*.yaml"
            - "actions/*/*.yml"
            - "containers/*/*.yaml"
            - "containers/*/*.yml"

permissions:
  contents: read

jobs:
  ## Task: Lint workflows in this respository with YAMLLint
  lint-workflows-yaml:
    name: "Workflows"
    runs-on: ${{ vars.RUNNER || 'ubuntu-latest' }}
    permissions:
        contents: "read"
        id-token: "write"
        checks: "write"
        pull-requests: "read"
    steps:
        - name: "Setup: Harden Runner"
          uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
          with:
            egress-policy: ${{ inputs.network || 'audit' }}
        - name: "Setup: Checkout"
          uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
          with:
            persist-credentials: false
        - name: "Setup: PNPM"
          uses: pnpm/action-setup@d882d12c64e032187b2edb46d3a0d003b7a43598 # v2.4.0
          with:
            version: ${{ env.PNPM_VERSION }}
        - name: "Setup: Node"
          uses: buildless/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.0
          with:
            node-version: ${{ env.NODE_VERSION }}
            cache: "pnpm"
        - name: "Setup: NPM Credentials"
          run: |
            echo "@buf:registry=https://buf.build/gen/npm/v1" >> ~/.npmrc;
            echo "//npm.buf.build/:_authToken=${{ secrets.BUF_NPM_TOKEN }}" >> ~/.npmrc;
        - name: "Setup: Install Packages"
          run: pnpm install --frozen-lockfile