check-workflows.yml

name: "Check workflows"
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:
  schedule:
    # Run every night at 3:15am PST (11:15am UTC)
    - cron: '15 11 * * *'

# Cancel in-progress runs of this workflow if a new run is triggered.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

permissions: {}

jobs:
  check-workflows:
    name: Check
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Install zizmor
        shell: bash
        run: |
            set -euo pipefail
            sudo apt-get update -y && sudo apt-get install -y cargo rustc
            cargo install --locked zizmor
            echo "$HOME/.cargo/bin" >>$GITHUB_PATH
      - name: Run zizmor
        env:
            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          zizmor --pedantic .