fix(ci): fetch skills contract history #17

	name: Actions lint

	# Mechanical review of the workflows themselves: actionlint for syntax and
	# shell issues, zizmor for GitHub Actions security smells. Both run from
	# version-pinned container images so results match local runs exactly.

	on:
	pull_request:
	paths:
	- ".github/workflows/**"
	push:
	branches: [main]
	paths:
	- ".github/workflows/**"
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	actionlint:
	runs-on: ubuntu-latest
	timeout-minutes: 5
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: Run actionlint
	run: \|
	docker run --rm -v "$PWD:/repo" --workdir /repo rhysd/actionlint:1.7.12 -color

	zizmor:
	runs-on: ubuntu-latest
	timeout-minutes: 5
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: Run zizmor
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	docker run --rm -e GH_TOKEN -v "$PWD:/repo" ghcr.io/zizmorcore/zizmor:1.27.0 /repo

Navigation Menu