check.yml

# SPDX-FileCopyrightText: 2022-2026 TII (SSRC) and the Ghaf contributors
#
# SPDX-License-Identifier: Apache-2.0

# Checks that run on github hosted runners and don't need authorization

name: check
on:
    push:
        branches:
            - main
    pull_request:
        branches:
            - main
permissions:
    contents: read
jobs:
    run-checks:
        runs-on: ubuntu-latest
        steps:
            - name: Harden the runner (Audit all outbound calls)
              uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
              with:
                  egress-policy: audit
            - name: Checkout
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  persist-credentials: false
            - name: Install nix
              uses: cachix/install-nix-action@19effe9fe722874e6d46dd7182e4b8b7a43c4a99 # v31.10.0
            - name: Nix flake check with no build
              run: nix flake check --option allow-import-from-derivation false --no-build