validate.yml

name: validate

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          enable-cache: true

      - name: Install dev dependencies
        run: make setup

      - name: Lint (ruff check + format)
        run: make lint

      - name: Shellcheck (scripts/*.sh)
        run: make shellcheck

      - name: Structural checks (manifests + frontmatter + guards)
        run: make test

      - name: GHA security (zizmor)
        run: make zizmor
        env:
          GH_TOKEN: ${{ github.token }}