validate-workflows.yml

name: Validate Workflows

permissions:
    contents: read

on:
    pull_request:
        paths:
            - .github/workflows/**

jobs:
    validate:
        runs-on: ubuntu-24.04
        steps:
            - name: Checkout
              uses: actions/checkout@v4
              with:
                  persist-credentials: false

            - name: Install Rust
              uses: dtolnay/rust-toolchain@stable
              with:
                  toolchain: stable

            - name: Cache cargo registry
              uses: actions/cache@v4
              with:
                  path: |
                      ~/.cargo/registry
                      ~/.cargo/git
                  key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
                  restore-keys: |
                      ${{ runner.os }}-cargo-registry-

            - name: Install zizmor
              run: cargo install --force zizmor

            - name: Validate all workflows
              working-directory: .github/workflows
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  BASE_REF: ${{ github.base_ref }}
              run: |
                  # Exit on any error
                  set -euo pipefail

                  # Initialize error flag
                  has_errors=0

                  # Validate inputs
                  if [ -z "${BASE_REF:-}" ]; then
                      echo "::error::BASE_REF is not set"
                      exit 1
                  fi

                  # Properly escape the base ref for use in git commands
                  base_ref=$(printf '%q' "$BASE_REF")

                  # Get list of changed files with error handling
                  changed_files=$(git diff --name-only "origin/${base_ref}" 2>/dev/null | \
                                grep -E '^\.github/workflows/[^/]+\.yml$' || true)

                  if [ -z "$changed_files" ]; then
                      echo "No workflow files changed"
                      exit 0
                  fi

                  # Loop through changed workflow files
                  while IFS= read -r file; do
                      [ -z "$file" ] && continue

                      # Safely handle filenames
                      filename=$(basename -- "$file")

                      # Skip non-yaml files
                      if [[ ! "$filename" =~ \.(ya?ml)$ ]]; then
                          continue
                      }

                      echo "Validating $filename..."

                      if ! zizmor "$filename" 2>/dev/null; then
                          echo "::error::Validation failed for $filename"
                          has_errors=1
                      fi
                  done <<< "$changed_files"

                  # Exit with error if any validation failed
                  if [ "$has_errors" -eq 1 ]; then
                      echo "::error::One or more workflow validations failed"
                      exit 1
                  fi

                  echo "All workflows validated successfully"