Skip to content
Workflow Security Linter

ci: bump dawidd6/action-send-mail from 6e502825a508b867ab2954ad6343b68787624c01 to c50dc4cc848ade21f848990889906d804fae78c5 #431

Sign in to view logs

ci: bump dawidd6/action-send-mail from 6e502825a508b867ab2954ad6343b68787624c01 to c50dc4cc848ade21f848990889906d804fae78c5

ci: bump dawidd6/action-send-mail from 6e502825a508b867ab2954ad6343b68787624c01 to c50dc4cc848ade21f848990889906d804fae78c5 #431

Workflow file for this run

.github/workflows/workflow-linter.yml at 648a117
# SPDX-License-Identifier: MPL-2.0
# Prevention workflow - validates all workflows have proper security config
name: Workflow Security Linter
on:
pull_request:
paths:
- '.github/workflows/**'
push:
paths:
- '.github/workflows/**'
permissions: read-all
# Actions concurrency pool. Applied only to read-only check workflows
# (no publish/mutation), so cancelling a superseded run is always safe.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
lint-workflows:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Check SPDX headers
run: |
errors=0
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -f "$f" ] || continue
if ! head -1 "$f" | grep -q "SPDX-License-Identifier"; then
echo "ERROR: $f missing SPDX header"
errors=$((errors + 1))
fi
done
exit $errors
- name: Check permissions declaration
run: |
errors=0
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -f "$f" ] || continue
if ! grep -q "^permissions:" "$f"; then
echo "ERROR: $f missing permissions declaration"
errors=$((errors + 1))
fi
done
exit $errors
- name: Check pinned actions
run: |
errors=0
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -f "$f" ] || continue
# Look for uses: without SHA
if grep -E "uses:.*@v[0-9]" "$f" | grep -v "#"; then
echo "WARNING: $f has unpinned actions (missing SHA comment)"
fi
done