workflow-linter.yml

---
name: Workflow Linter

on:
  pull_request:
    paths:
      - .github/workflows/**
  workflow_call: {}
  workflow_dispatch: {}

jobs:
  lint:
    name: "Workflow Linter"
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout Branch
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0

      - name: Get changed workflows
        id: changed-workflows
        run: |
          MODIFIED_WORKFLOWS=$(git diff --name-only origin/${{ github.base_ref	}} | grep -E '.github/workflows/.*.(yml|yaml)' | tr '\n' ' ')
          MODIFIED_EXISTING_WORKFLOWS=""
          for workflow in $MODIFIED_WORKFLOWS; do
              if [ -f $workflow ]; then
                  MODIFIED_EXISTING_WORKFLOWS+=" ${workflow}"
              fi
          done
          echo "modified-workflows=$MODIFIED_EXISTING_WORKFLOWS" >> $GITHUB_OUTPUT

      - name: Test for Lint
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0

      - name: Workflow Lint
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        uses: bitwarden/gh-actions/lint-workflow@main
        with:
          workflows: ${{ steps.changed-workflows.outputs.modified-workflows }}

      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@94549999469dbfa032becf298d95c87a14c34394 # v40.2.2
        with:
          files: .github/workflows/**

      - name: Check for pinned versions
        if: steps.changed-files.outputs.any_changed == 'true'
        shell: bash
        env:
          FILE: ${{ steps.changed-files.outputs.all_changed_files }}
        run: |
          FILES=$(echo "${{ env.FILE }}")
          curl -o $PWD/version-lint.sh https://raw.githubusercontent.com/bitwarden/gh-actions/main/.github/version-lint.sh
          chmod +x $PWD/version-lint.sh && $PWD/version-lint.sh $FILES