Add explicit awesome lint PR check

Author: PatrickJS

.github/workflows/main.yml

@@ -92,6 +92,35 @@ jobs:
         if: github.event_name == 'pull_request'
         run: node .trusted-base/scripts/check-repo-hygiene.mjs --root "$GITHUB_WORKSPACE" --changed-files .changed-files --diff-file .readme.diff
 
+      - name: Run repo hygiene checks
+        if: github.event_name != 'pull_request'
+        run: node scripts/check-repo-hygiene.mjs --changed-files .changed-files --diff-file .readme.diff
+
+  awesome-lint:
+    name: awesome-lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 1
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 20
+
+      - name: Enable pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@10.20.0 --activate
+
+      - name: Checkout trusted base checks
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          path: .trusted-base
+          fetch-depth: 1
+
       - name: Run trusted awesome-list checks
         if: github.event_name == 'pull_request'
         run: |
@@ -107,7 +136,3 @@ jobs:
         run: |
           pnpm run check:awesome-list
           pnpm run check:awesome-list:upstream
-
-      - name: Run repo hygiene checks
-        if: github.event_name != 'pull_request'
-        run: node scripts/check-repo-hygiene.mjs --changed-files .changed-files --diff-file .readme.diff

scripts/workflow-security.test.mjs

@@ -19,12 +19,17 @@ test("pull request hygiene runs the trusted base copy of the script", () => {
   );
 });
 
-test("pull request hygiene runs trusted awesome-list checks", () => {
+test("workflow has an explicit awesome-lint job for every pull request", () => {
+  assert.match(workflow, /^  awesome-lint:\n\s+name:\s+awesome-lint\n\s+runs-on:\s+ubuntu-latest$/m);
+  assert.match(workflow, /^  pull_request:\n\s+branches:\s+\[main\]$/m);
+});
+
+test("pull requests run trusted awesome-list checks", () => {
   assert.match(workflow, /node \.trusted-base\/scripts\/check-awesome-list\.mjs --root "\$GITHUB_WORKSPACE"/);
   assert.match(workflow, /pnpm dlx awesome-lint "\$GITHUB_WORKSPACE\/README\.md"/);
 });
 
-test("push hygiene runs local awesome-list checks", () => {
+test("pushes run local awesome-list checks", () => {
   assert.match(workflow, /pnpm install --frozen-lockfile/);
   assert.match(workflow, /pnpm run check:awesome-list/);
   assert.match(workflow, /pnpm run check:awesome-list:upstream/);