ci.yml

name: ci.yml

permissions:
  contents: read

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  check-pinned-actions:
    name: Check actions are SHA-pinned
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false

      - name: Check actions are SHA-pinned
        uses: suzuki-shunsuke/pinact-action@cf51507d80d4d6522a07348e3d58790290eaf0b6 # v2.0.0
        with:
          skip_push: "true"
          github_token: ${{ secrets.GITHUB_TOKEN }}

  test-scripts:
    name: Test Python scripts
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Setup Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: '3.x'

      - name: Install pytest
        run: pip install pytest

      - name: Run script tests
        run: pytest scripts/ -v

  zizmor:
    name: Workflow security audit (zizmor)
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3