name: CI Quality

on:
  push:
    branches: [main]
    paths-ignore:
      - '**/*.md'
      - 'LICENSE'
      - '.github/releases/**'
  pull_request:
    branches: [main]
    paths-ignore:
      - '**/*.md'
      - 'LICENSE'
      - '.github/releases/**'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  lint-actionlint:
    name: Lint GitHub Actions (actionlint)
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
        with:
          args: "-color"

  lint-zizmor:
    name: Lint GitHub Actions (zizmor)
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
        with:
          advanced-security: "false"
          annotations: "true"
          config: .github/zizmor.yml

  check-typos:
    name: Check typos
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: crate-ci/typos@5374cbf686e897b15713110e233094e2874de7ef # v1.46.1
