workflow-linter.yml

name: Lint workflow

on:
  pull_request:
    paths:
      - .github/workflows/**
  merge_group:
    types: [checks_requested]
  workflow_call:
  workflow_dispatch:

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-22.04
    steps:
      - name: Get repository
        id: repo
        env:
          REPO: ${{ github.repository }}
        run: |
          echo $REPO
          echo "repo=$REPO" >> $GITHUB_OUTPUT

      - name: Check out branch
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: ${{ steps.repo.outputs.repo }}
          fetch-depth: 0

      - name: Get changed workflows
        id: changed-workflows
        run: |
          MODIFIED_WORKFLOWS=$(git diff --name-only origin/${{ github.base_ref	}} | grep -E '.github/workflows/.*.(yml|yaml)' | tr '\n' ' ')
          MODIFIED_EXISTING_WORKFLOWS=""
          COUNT=0
          for workflow in $MODIFIED_WORKFLOWS; do
              if [ -f $workflow ]; then
                  MODIFIED_EXISTING_WORKFLOWS+=" ${workflow}"
                  COUNT=$((COUNT+1))
              fi
          done
          echo "count=$COUNT" >> $GITHUB_OUTPUT
          echo "modified-workflows=$MODIFIED_EXISTING_WORKFLOWS" >> $GITHUB_OUTPUT

      - name: Set up Python 3.11
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: "3.11"

      - name: Upgrade pip and install bwwl binary
        # if: steps.changed-workflows.outputs.count != 0
        run: |
          python -m pip install --upgrade pip
          python -m pip install --upgrade bitwarden_workflow_linter

      - name: Lint
        # if: steps.changed-workflows.outputs.count != 0
        run: bwwl lint -f ./github/workflows

      - name: Get changed files
        # if: steps.changed-workflows.outputs.count != 0
        id: changed-files
        uses: tj-actions/changed-files@c3a1bb2c992d77180ae65be6ae6c166cf40f857c # v45.0.3
        with:
          files: .github/workflows/**

      - name: Check for pinned versions
        if: steps.changed-files.outputs.any_changed == 'true'
        shell: bash
        env:
          FILE: ${{ steps.changed-files.outputs.all_changed_files }}
        run: |
          FILES=$(echo "${{ env.FILE }}")
          curl -o $PWD/version-lint.sh https://raw.githubusercontent.com/bitwarden/gh-actions/main/.github/version-lint.sh
          chmod +x $PWD/version-lint.sh && $PWD/version-lint.sh $FILES