Repository navigation

chore(deps): bump dawidd6/action-send-mail from 8de3c312702ac7a63fc4035d45a2a51811eb669a to 0bbdab096651ee93f37ec02383e088183d41ff0b in the actions group #181

	# SPDX-License-Identifier: MPL-2.0
	# Prevention workflow - validates all workflows have proper security config
	name: Workflow Security Linter

	on:
	pull_request:
	paths:
	- '.github/workflows/**'
	push:
	paths:
	- '.github/workflows/**'

	permissions: read-all

	jobs:
	lint-workflows:
	runs-on: ubuntu-latest
	timeout-minutes: 15
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4

	- name: Check SPDX headers
	run: \|
	errors=0
	for f in .github/workflows/.yml .github/workflows/.yaml; do
	[ -f "$f" ] \|\| continue
	if ! head -1 "$f" \| grep -q "SPDX-License-Identifier"; then
	echo "ERROR: $f missing SPDX header"
	errors=$((errors + 1))
	fi
	done
	exit $errors

	- name: Check permissions declaration
	run: \|
	errors=0
	for f in .github/workflows/.yml .github/workflows/.yaml; do
	[ -f "$f" ] \|\| continue
	if ! grep -q "^permissions:" "$f"; then
	echo "ERROR: $f missing permissions declaration"
	errors=$((errors + 1))
	fi
	done
	exit $errors

	- name: Check pinned actions
	run: \|
	errors=0
	for f in .github/workflows/.yml .github/workflows/.yaml; do
	[ -f "$f" ] \|\| continue
	# Look for uses: without SHA
	if grep -E "uses:.*@v[0-9]" "$f" \| grep -v "#"; then
	echo "WARNING: $f has unpinned actions (missing SHA comment)"
	fi
	done