name: check action compliance

on:
  pull_request:
    paths:
      - .github/workflows/**
  push:
    branches:
      - main
      - 'release/*'

jobs:
  action-pin:
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Ensure SHA pinned actions
        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@64418826697dcd77c93a8e4a1f7601a1942e57b5 # v3.0.18
        with:
          allowlist: |
            slsa-framework/slsa-github-generator

  action-lint:
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: check-missing-teardown
        run: .github/workflows/scripts/teardown-check.sh
      - name: actionlint
        uses: raven-actions/actionlint@01fce4f43a270a612932cb1c64d40505a029f821 # v2.0.0
