chore: test out claws sast

.github/workflows/claws.yaml

@@ -0,0 +1,53 @@
+name: Workflow Static Analyzer
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  build:
+    name: Analyze Github Workflows
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set Up Ruby
+        uses: ruby/setup-ruby@d8d83c3960843afb664e821fed6be52f37da5267 # v1.231.0
+        with:
+          ruby-version: "3.0"
+      - name: Set Up Claws Config
+        run: |
+          echo ... > /tmp/claws-config.yml
+      - name: Set Up Shellcheck
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Set Up Claws
+        run: |
+          gem install claws-scan -v 0.7.5
+      - name: Analyze Workflows
+        run: |
+          #!/bin/bash
+
+          # Collect all files in the .github/workflows directory
+          workflow_files=$(find .github/workflows -type f)
+
+          # Exit early if there are no workflow files
+          if [[ -z "$workflow_files" ]]; then
+            echo "No workflow files found in .github/workflows"
+            exit 0
+          fi
+
+          flags=()
+
+          # Iterate over each workflow file
+          while IFS= read -r file; do
+            echo "Processing $file"
+            flags+=("-t" "$file")
+          done <<< "$workflow_files"
+
+          # Run the analyze command with all gathered flags
+          analyze -f github -c /tmp/claws-config.yml "${flags[@]}"