mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-09 18:28:15 +01:00
34 lines
1.4 KiB
YAML
34 lines
1.4 KiB
YAML
name: Workflow Lint
|
|
# push is main-only: a push to a PR branch already fires the pull_request run;
|
|
# the unrestricted push trigger double-ran every PR commit.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
# PR-number keyed (run_id fallback for push): a bare branch name carries no
|
|
# fork prefix, so same-name branches from two forks would share one group and
|
|
# cancel each other's runs (same rationale as free-tests.yml).
|
|
concurrency:
|
|
group: actionlint-${{ github.event.pull_request.number || github.run_id }}
|
|
cancel-in-progress: true
|
|
|
|
# Lint needs nothing from the token; the job runs a third-party image with
|
|
# the checkout mounted, so keep the grant read-only and out of .git/config.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
actionlint:
|
|
runs-on: ubicloud-standard-2
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
# Pull the prebuilt image instead of rhysd/actionlint@v1.7.11 (a Docker
|
|
# action that rebuilt from source every run: 16s of a 44s job for 1s of
|
|
# lint). Pinned by DIGEST: a Docker Hub tag is repointable with no
|
|
# GitHub-side audit trail, and this image sees the mounted checkout.
|
|
- run: docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:1.7.11@sha256:6f03470d0152251d7f07f7c4dc019dbe7024c72cd952f839544c7798843efa8f -color
|