ci.yml

name: CI
on:
  push:
    branches: ['master']
  # This workflow contains required checks and needs to run for EVERY pull_request
  pull_request:
    branches: ['**']

permissions: {}

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  ACTIONLINT_VERSION: "1.7.12"
  ACTIONLINT_SHA256SUM: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
  ACTIONLINT_REPO: rhysd/actionlint
  GH_TELEMETRY: "false"

jobs:
  actionlint:
    # Required check; do not change name
    name: actionlint
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: "3.14"

      - name: Install Python dependencies
        run: |
          python -m pip install -U --require-hashes -r "requirements/pip.txt"
          python -m pip install -U --require-hashes -r "requirements/pyflakes.txt"

      - name: Install requirements
        env:
          GH_TOKEN: ${{ github.token }}
          ACTIONLINT_TARBALL: ${{ format('actionlint_{0}_linux_amd64.tar.gz', env.ACTIONLINT_VERSION) }}
        shell: bash
        run: |
          sudo apt -y install shellcheck
          gh release download \
            --repo "${ACTIONLINT_REPO}" \
            --pattern "${ACTIONLINT_TARBALL}" \
            "v${ACTIONLINT_VERSION}"
          gh attestation verify \
            --repo "${ACTIONLINT_REPO}" \
            "${ACTIONLINT_TARBALL}"
          printf '%s  %s' "${ACTIONLINT_SHA256SUM}" "${ACTIONLINT_TARBALL}" | sha256sum -c -
          tar xvzf "${ACTIONLINT_TARBALL}" actionlint
          sudo install -D --mode=755 actionlint /usr/bin/

      - name: Run actionlint
        run: |
          actionlint -color

  zizmor:
    # Required check; do not change name
    name: zizmor
    permissions:
      contents: read
      actions: read  # Needed by zizmorcore/zizmor-action if repository is private
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d  # v0.5.6
        with:
          advanced-security: false
          persona: pedantic