verify-github-actions.yaml

---
# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: 2024 The Linux Foundation

# Verifies action/workflow calls are pinned to SHA commit values
name: 📌 Audit GitHub Actions

# yamllint disable-line rule:truthy
on:
  workflow_dispatch:
  pull_request:
    branches:
      - main
      - master
    paths: [".github/**"]

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    name: Verify
    # yamllint disable-line rule:line-length
    uses: os-climate/osc-github-devops/.github/workflows/reuse-verify-github-actions.yaml@c79cd65f11421fedfadcc70ea1316471bbca565a # 2025-01-16
    permissions:
      contents: read