ci: bump dawidd6/action-send-mail from 12335b969ae3fb71bee5f2c6b829744261aec34c to 2e600f3776677e493bf0da7aaec39a586d19a5ed in the github-actions group #511

	# SPDX-License-Identifier: MPL-2.0
	# Prevention workflow - validates all workflows have proper security config
	name: Workflow Security Linter
	on:
	pull_request:
	paths:
	- '.github/workflows/**'
	push:
	paths:
	- '.github/workflows/**'
	permissions: read-all
	# Actions concurrency pool. Applied only to read-only check workflows
	# (no publish/mutation), so cancelling a superseded run is always safe.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true
	jobs:
	lint-workflows:
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- name: Check SPDX headers
	run: \|
	errors=0
	for f in .github/workflows/.yml .github/workflows/.yaml; do
	[ -f "$f" ] \|\| continue
	if ! head -1 "$f" \| grep -q "SPDX-License-Identifier"; then
	echo "ERROR: $f missing SPDX header"
	errors=$((errors + 1))
	fi
	done
	exit $errors
	- name: Check permissions declaration
	run: \|
	errors=0
	for f in .github/workflows/.yml .github/workflows/.yaml; do
	[ -f "$f" ] \|\| continue
	if ! grep -q "^permissions:" "$f"; then
	echo "ERROR: $f missing permissions declaration"
	errors=$((errors + 1))
	fi
	done
	exit $errors
	- name: Check pinned actions
	run: \|
	errors=0
	for f in .github/workflows/.yml .github/workflows/.yaml; do
	[ -f "$f" ] \|\| continue
	# Look for uses: without SHA
	if grep -E "uses:.*@v[0-9]" "$f" \| grep -v "#"; then
	echo "WARNING: $f has unpinned actions (missing SHA comment)"
	fi
	done

Navigation Menu