check.lint-yaml.yml

---
name: "Lint: YAML"

concurrency:
  group: lint-yaml-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

"on":
  ## Check YAML on merge queue insertion
  merge_group: {}

  ## Check on release
  release:
    types: [created]

  ## Check on push to `main` if modified
  push:
    branches:
      - main
    paths:
      - ".github/workflows/*.yaml"
      - ".github/workflows/*.yml"
      - ".bazelci/presubmit.yml"
      - ".bcr/*.yml"

  ## Check each PR change against `main`
  pull_request:
    paths:
      - ".github/workflows/*.yaml"
      - ".github/workflows/*.yml"
      - ".bazelci/presubmit.yml"
      - ".bcr/*.yml"

permissions:
  contents: read

jobs:
  ## Task: Lint workflows via Actionlint
  lint-workflows:
    name: "Lint: Workflows"
    uses: elide-dev/build-infra/.github/workflows/check.actions-lint.ci.yml@ae4a1343b5e45ea1e2133f0105863058a1d0527c
    permissions:
      checks: write
      pull-requests: read
      id-token: write
      contents: read

  ## Task: Lint Bazel Central Registry config files
  lint-bcr-yaml:
    name: "Lint: BCR"
    runs-on: ubuntu-latest
    permissions:
      contents: "read"
      id-token: "write"
      checks: "write"
      pull-requests: "read"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
      - name: "Setup: Checkout"
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
      - name: "Lint: YAML"
        uses: karancode/yamllint-github-action@0a904064817924fc6fb449a32f67f25bfacc48ae # master
        with:
          yamllint_file_or_dir: ".bcr"
          yamllint_config_filepath: "./.github/.yamllint.yml"
        env:
          GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  ## Task: Lint Bazel CI config files
  lint-bazelci-yaml:
    name: "Lint: Bazel CI"
    runs-on: ubuntu-latest
    permissions:
      contents: "read"
      id-token: "write"
      checks: "write"
      pull-requests: "read"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
      - name: "Setup: Checkout"
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
      - name: "Lint: YAML"
        uses: karancode/yamllint-github-action@0a904064817924fc6fb449a32f67f25bfacc48ae # master
        with:
          yamllint_file_or_dir: ".bazelci"
          yamllint_config_filepath: "./.github/.yamllint.yml"
        env:
          GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}