feat: add the install-pinned-tool action and consume it in every workflow #77

	name: CI

	on:
	push:
	branches: [main]
	pull_request:

	permissions:
	contents: read

	# One run per ref: a quick follow-up commit cancels the superseded run.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	format-and-lint:
	name: format and lint
	runs-on: ubuntu-24.04
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false
	- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
	with:
	python-version: "3.13"
	# Version and checksum live in the action's pin table.
	- name: Install actionlint
	uses: ./actions/install-pinned-tool
	with:
	tool: actionlint
	- name: Install zizmor
	run: pip install zizmor==1.26.1
	- name: Run pre-commit
	run: \|
	pip install pre-commit==4.6.0
	SKIP=gitleaks pre-commit run --all-files --show-diff-on-failure

	# Calls the catalog's own block: one mechanism serves as the scan and as the block's
	# proof, and the gitleaks pin lives in one file.
	secret-scan:
	name: secret scan
	uses: ./.github/workflows/security-secret-scan.yml

Navigation Menu