.lint.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

# One run per ref: a quick follow-up commit cancels the superseded run.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  format-and-lint:
    name: format and lint
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.13"
      # Version and checksum live in the action's pin table.
      - name: Install actionlint
        uses: ./actions/install-pinned-tool
        with:
          tool: actionlint
      - name: Install zizmor
        run: pip install zizmor==1.26.1
      - name: Run pre-commit
        run: |
          pip install pre-commit==4.6.0
          SKIP=gitleaks pre-commit run --all-files --show-diff-on-failure

  # Calls the catalog's own block: one mechanism serves as the scan and as the block's
  # proof, and the gitleaks pin lives in one file.
  secret-scan:
    name: secret scan
    uses: ./.github/workflows/security-secret-scan.yml