# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1

name: Workflow Security

# zizmor reads the workflows of this repository for what makes a workflow
# unsafe: a token that is wider than its job needs, text from a pull request
# that reaches a shell, an action that is not pinned. Its findings are
# uploaded to code scanning.

on:
  pull_request:
  push:
    branches:
      - main

permissions: {}

concurrency:
  group: zizmor-${{ github.ref }}
  cancel-in-progress: true

jobs:
  zizmor:
    name: zizmor
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Audit the workflows
        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4

  actionlint:
    name: actionlint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: 1.26.10
          cache: false
      # actionlint checks the syntax, the expressions and the shell steps of
      # every workflow; zizmor above checks what makes one unsafe.
      - name: Lint the workflows
        run: |
          go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
          "$(go env GOPATH)/bin/actionlint" -color