ci-checks.yml

name: ci - checks
on:
  push:
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  sh-checker:
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false

      - name: Run the sh-checker
        uses: luizm/action-sh-checker@17bd25a6ee188d2b91f677060038f4ba37ba14b2 # v0.9.0
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SHELLCHECK_OPTS: -e SC2034,SC1091 # It is possible to exclude some shellcheck warnings.
          SHFMT_OPTS: -ci -sr -i 0 # It is possible to pass arguments to shftm
        with:
          sh_checker_comment: true
          sh_checker_exclude: ""

  zizmor-checker:
    runs-on: ubuntu-24.04-arm
    permissions:
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false

      - name: Run zizmor 🌈
        uses: zizmorcore/zizmor-action@e673c3917a1aef3c65c972347ed84ccd013ecda4 # v0.2.0

  editorconfig-checker:
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false

      - name: editorconfig-checker
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          curl -Lo- "https://github.com/editorconfig-checker/editorconfig-checker/releases/latest/download/ec-linux-amd64.tar.gz" | tar xzf - --strip-components=1

          printf '%b\n' "\`\`\`" >> $GITHUB_STEP_SUMMARY
          ./ec-linux-amd64 --exclude '^(docs/.*|patches/.*)$' | sed "s,\x1B\[[0-9;]*[a-zA-Z],,g" >> $GITHUB_STEP_SUMMARY
          exit_code=("${PIPESTATUS[0]}")
          printf '%b' "\`\`\`" >> $GITHUB_STEP_SUMMARY

          # exit "${exit_code}"