name: Lint GitHub Actions workflows
on:
  push:
    branches: ["main"]
    paths: [".github/**"]
  pull_request:
    paths: [".github/**"]
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  actionlint:
    uses: mozilla/actions/.github/workflows/actionlint.yml@2e46408d5c495e59a21e5e125e82008fad0d9408 # v1.1.7
    permissions:
      contents: read
      security-events: write # Required for zizmor to upload SARIF results.