chore(deps): Bump dawidd6/action-send-mail from 6e502825a508b867ab2954ad6343b68787624c01 to 994f270325d4f7257aff241a35488ef54ba364a4 in the actions group #224
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # Prevention workflow - validates all workflows have proper security config | |
| name: Workflow Security Linter | |
| on: | |
| pull_request: | |
| paths: | |
| - '.github/workflows/**' | |
| push: | |
| paths: | |
| - '.github/workflows/**' | |
| permissions: read-all | |
| jobs: | |
| lint-workflows: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4 | |
| - name: Check SPDX headers | |
| run: | | |
| errors=0 | |
| for f in .github/workflows/*.yml .github/workflows/*.yaml; do | |
| [ -f "$f" ] || continue | |
| if ! head -1 "$f" | grep -q "SPDX-License-Identifier"; then | |
| echo "ERROR: $f missing SPDX header" | |
| errors=$((errors + 1)) | |
| fi | |
| done | |
| exit $errors | |
| - name: Check permissions declaration | |
| run: | | |
| errors=0 | |
| for f in .github/workflows/*.yml .github/workflows/*.yaml; do | |
| [ -f "$f" ] || continue | |
| if ! grep -q "^permissions:" "$f"; then | |
| echo "ERROR: $f missing permissions declaration" | |
| errors=$((errors + 1)) | |
| fi | |
| done | |
| exit $errors | |
| - name: Check pinned actions | |
| run: | | |
| errors=0 | |
| for f in .github/workflows/*.yml .github/workflows/*.yaml; do | |
| [ -f "$f" ] || continue | |
| # Look for uses: without SHA | |
| if grep -E "uses:.*@v[0-9]" "$f" | grep -v "#"; then | |
| echo "WARNING: $f has unpinned actions (missing SHA comment)" | |
| fi | |
| done |