Repository navigation

Resolve merge conflicts in 1 file(s) #1155

	# This workflow is managed by gh actions-lock.
	# SPDX-License-Identifier: MPL-2.0
	# This workflow is managed by gh actions-lock.
	# Prevention workflow - validates all workflows have proper security config
	name: Workflow Security Linter

	on:
	pull_request:
	paths:
	- '.github/workflows/**'
	- 'scripts/ci/**'
	- '.hypatia-ignore'
	push:
	paths:
	- '.github/workflows/**'
	- 'scripts/ci/**'
	- '.hypatia-ignore'

	permissions: read-all

	jobs:
	lint-workflows:
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@v7.0.1

	- name: Check workflow policy and issue regressions
	# Duplicate YAML keys are rejected before Actions creates any jobs.
	# Also validates SPDX in the comment preamble (actions-lock inserts a
	# banner before it), permissions, migration exemptions and risk routing.
	run: bash scripts/ci/test-issue-regressions.sh

	# Ultraplan Phase 2.3 (tracking issue #416): every continue-on-error unit
	# needs an owner issue and an unexpired date on the same line.
	- name: Allow-fail units have an owner and an unexpired date
	run: bash scripts/ci/check-allow-fail-expiry.sh

	# actions.lock is verified by governance's lockfile check (standards
	# scripts/update-actions-lock.sh): one tested implementation, one
	# gh-actions-lock pin, and it accepts reusable-workflow coverage. The step
	# that stood here pinned its own v0.1.6 binary, which cannot read
	# lockfile v0.0.3, so it failed whenever a current tool wrote the lock.