.github/workflows/validate-actions.yml

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Validate GitHub Actions

on:
  pull_request:
    paths:
      - '.github/workflows/**'
      - 'build-logic/src/main/groovy/org/apache/groovy/gradle/ValidateActionsTask.groovy'
  push:
    branches: [master]
    paths:
      - '.github/workflows/**'
      - 'build-logic/src/main/groovy/org/apache/groovy/gradle/ValidateActionsTask.groovy'
  schedule:
    - cron: '0 6 * * 1'  # weekly Monday 06:00 UTC — catches ASF delisting a pinned SHA
  workflow_dispatch:

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-java@v5
        with:
          distribution: 'zulu'
          java-version: 21
          check-latest: true
      - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
      - name: Validate Actions
        run: ./gradlew validateActions --no-daemon
        timeout-minutes: 5