Merge branch 'main' into dependabot/github_actions/actions-2d3ed2d690 #997

	# SPDX-License-Identifier: AGPL-3.0-or-later
	# This workflow is managed by gh actions-lock.
	# Prevention workflow - validates all workflows have proper security config
	name: Workflow Security Linter

	on:
	pull_request:
	paths:
	- '.github/workflows/**'
	push:
	paths:
	- '.github/workflows/**'

	permissions: read-all

	jobs:
	lint-workflows:
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@v7.0.1

	- name: Check SPDX headers
	run: \|
	errors=0
	for f in .github/workflows/.yml .github/workflows/.yaml; do
	[ -f "$f" ] \|\| continue
	if ! head -1 "$f" \| grep -q "SPDX-License-Identifier"; then
	echo "ERROR: $f missing SPDX header"
	errors=$((errors + 1))
	fi
	done
	exit $errors

	- name: Check permissions declaration
	run: \|
	errors=0
	for f in .github/workflows/.yml .github/workflows/.yaml; do
	[ -f "$f" ] \|\| continue
	if ! grep -q "^permissions:" "$f"; then
	echo "ERROR: $f missing permissions declaration"
	errors=$((errors + 1))
	fi
	done
	exit $errors

	- name: Verify immutable action lockfile with the authoritative tool
	env:
	GH_TOKEN: ${{ github.token }}
	run: \|
	curl -fsSL --retry 3 -o "$RUNNER_TEMP/gh-actions-lock" https://github.com/github/gh-actions-lock/releases/download/v0.1.6/linux-amd64
	echo "4181ec1da5408b34b9a542a7ee5c6ce3a4d6ac815c7d0206a00ceca8a817f4e3 $RUNNER_TEMP/gh-actions-lock" \| sha256sum --check
	chmod u+x "$RUNNER_TEMP/gh-actions-lock"
	"$RUNNER_TEMP/gh-actions-lock" --rescan --no-fix

Navigation Menu