lint.yaml

name: lint

on:
  push: {}

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22

      - name: shellcheck
        run: |
          mapfile -t scripts < <(find . -name '*.sh' -not -path './.git/*' | sort)
          nix shell github:NixOS/nixpkgs/nixpkgs-26.05-darwin#shellcheck --command shellcheck "${scripts[@]}"

      - name: actionlint
        run: nix shell github:NixOS/nixpkgs/nixpkgs-26.05-darwin#actionlint --command actionlint

      - name: zizmor
        run: nix shell github:NixOS/nixpkgs/nixpkgs-26.05-darwin#zizmor --command zizmor .

      - name: statix
        run: nix shell github:NixOS/nixpkgs/nixpkgs-26.05-darwin#statix --command statix check .