ci(deps): bump the github-actions group across 1 directory with 4 updates #148
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # © 2026 NetApp, Inc. All Rights Reserved. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # See the NOTICE file in the repo root for trademark and attribution details. | |
| name: PR Guard | |
| on: | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| jobs: | |
| commitlint: | |
| name: commitlint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1 | |
| secrets: | |
| name: secret-scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: TruffleHog scan | |
| uses: trufflesecurity/trufflehog@20652fbbdefffcdaa493a5bf57ab2ac6b1db715b # v3.97.1 | |
| with: | |
| extra_args: --only-verified | |
| yaml-syntax: | |
| name: Validate YAML syntax | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.11" | |
| - name: Check changed YAML files | |
| run: | | |
| CHANGED_YAML=$(git diff --name-only --diff-filter=ACM origin/main...HEAD \ | |
| | grep '\.ya\?ml$' || true) | |
| if [ -z "$CHANGED_YAML" ]; then | |
| echo "No YAML files changed" | |
| exit 0 | |
| fi | |
| pip install -q -r requirements-dev.txt | |
| ERRORS=0 | |
| while IFS= read -r f; do | |
| if ! python -c "import yaml; yaml.safe_load(open('$f'))" 2>/dev/null; then | |
| echo "::error file=$f::YAML syntax error in $f" | |
| ERRORS=$((ERRORS + 1)) | |
| else | |
| echo " OK $f" | |
| fi | |
| done <<< "$CHANGED_YAML" | |
| [ "$ERRORS" -eq 0 ] || exit 1 |