ci.yaml

name: CI

# ↓ lock down top‐level permissions to only what we use
permissions:
  contents: read             # we only need to checkout code
  actions: read              # to query workflows/runs
  statuses: write

# Run on pushes to any branch and pull requests
on:
  push:
    branches: ['main']
  pull_request:
    branches: ['**']

jobs:
  # Lint all YAML, JSON & Shell
  lint:
    name: Lint code & configs
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run Super-linter
        uses: github/super-linter@v7
        env:
          # only lint the file types you care about
          VALIDATE_YAML: true
          VALIDATE_JSON: true
          VALIDATE_SHELL: true
          VALIDATE_BASH: true
          VALIDATE_BASH_EXEC: true
          VALIDATE_CHECOV: true
          VALIDATE_GITHUB_ACTIONS: true
          VALIDATE_GITLEAKS: true
          VALIDATE_NATURAL_LANGUAGE: true
          VALIDATE_MARKDOWN: true
          FILTER_REGEX_EXCLUDE: (^cardano-config/|LICENSE\.md)
          # tell it your default branch so it can diff
          DEFAULT_BRANCH: origin/main
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}