Spaces:
Paused
Paused
| name: Validate All GitHub Actions | |
| on: | |
| push: | |
| branches: | |
| - "master" | |
| - "[0-9].[0-9]*" | |
| pull_request: | |
| branches: | |
| - "**" | |
| permissions: | |
| contents: read | |
| # cancel previous workflow jobs for PRs | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| validate-all-ghas: | |
| runs-on: ubuntu-26.04 | |
| permissions: | |
| contents: read | |
| # Required for the zizmor action to upload its SARIF results to | |
| # GitHub code scanning (advanced-security is enabled by default). | |
| security-events: write | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: "20" | |
| - name: Install Dependencies | |
| # Versions are pinned to avoid ad-hoc, unpinned package installs. | |
| # Bump deliberately when upgrading. | |
| # zizmor: ignore[adhoc-packages] - @action-validator is a global CLI tool installed to validate the repo's workflows; a global CLI install has no application manifest/lockfile context, and the versions are pinned above | |
| run: npm install -g @action-validator/core@0.6.0 @action-validator/cli@0.6.0 | |
| - name: Run Script | |
| run: bash .github/workflows/github-action-validator.sh | |
| - name: Test docs-deploy freshness gate | |
| run: bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh | |
| - name: Check for security issues on GHA workflows | |
| uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 | |