security-scan.yml

name: Security Scan - Workflows

on:
  pull_request:
    branches:
      - main
      - 'support/**'
  push:
    branches:
      - main
      - 'support/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Deny-all default; jobs grant the minimum they need.
permissions: {}

jobs:
  zizmor:
    name: Zizmor Security Scan
    runs-on: uipath-ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read

    steps:
      - name: Checkout code
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
        with:
          persist-credentials: false

      - name: Run Zizmor Security Scan
        uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1
        with:
          advanced-security: true
          min-confidence: medium
          min-severity: medium
          persona: regular
        env:
          ZIZMOR_CONFIG: zizmor.yml

  actionlint:
    name: Actionlint Workflow Syntax Check
    runs-on: uipath-ubuntu-latest
    # github-pr-check reporter only surfaces results in PR context; skip on push.
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      checks: write

    steps:
      - name: Checkout code
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
        with:
          persist-credentials: false

      - name: Run actionlint
        # Catches a different class of issues than zizmor (syntax, expression typos, shellcheck on run: blocks).
        uses: reviewdog/action-actionlint@7abf25e1607ec65838b73d0484ff31f8e9499d80 # v1.81.2
        with:
          reporter: github-pr-check
          fail_on_error: true