Run the workflows against this repo on merge and PR

[kaiomagalhaes]

This repository ships reusable workflows and had no CI of its own. Nothing was exercised until after it had already landed in every consuming repo — and since they all reference @main unpinned, production was the test environment.

Two bugs shipped exactly that way: a documented allowed_outdated_libraries input that never existed in the workflow, and gate steps whose jq check ignored --audit-level entirely.

What runs

secret-scan — calls security.yml on this repo. Dogfooding: if the scanner breaks, it breaks here first.

• notify_webhook: false — there is no SECURITY_WEBHOOK_URL secret in this repo, and validate-inputs correctly fails when notifications are on without one.
• scan_filesystem: true — safe, because those findings are advisory and cannot block.

lint-workflows — runs actionlint, which validates workflow syntax, expressions and contexts, and runs shellcheck over the inline run: scripts. That last part matters most here: the real logic in this repo lives in shell inside YAML, which nothing else checks.

It installs from a pinned release with checksum verification rather than pulling a third-party action — consistent with how TruffleHog is installed in security.yml, and with this repo's own rule about not trusting mutable refs inside a security pipeline.

Triggers

push to main and pull_request. You asked for merges to main; I added PR runs too, because catching a break before it merges is the actual goal — consumers pick up @main the instant it lands, so a post-merge signal is already too late. Happy to drop the PR trigger if you'd rather keep it to main only.

What is deliberately not run

node-security-dependency-scan.yml is not called. It runs npm ci, and this repository has no package.json, so it would fail for reasons that say nothing about whether the workflow is correct. Worth revisiting if a fixture project is ever added here.

One existing issue fixed

actionlint found SC2129 in node-security-dependency-scan.yml — individual redirects to $GITHUB_STEP_SUMMARY in the OWASP report step. Converted to a single grouped redirect so the new lint job starts green rather than red on arrival.

Verification

I ran actionlint locally rather than assuming it would pass:

actionlint 1.7.12 — exit 0, no issues across all four workflow files

And confirmed the install step's checksum grep against the real actionlint release:

8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  actionlint_1.7.12_linux_amd64.tar.gz
✅ matches exactly one line

Note this PR is the first real test of itself — the pull_request trigger means both jobs should run on this very PR.

Kept separate from #11 (README rewrite) so that one stays docs-only.

[kaiomagalhaes]

Updated per feedback: runs on every branch push, not just main.

on:
  push:
    branches: ["**"]

This matches how consuming repos call these workflows. I dropped the pull_request trigger — with pushes on all branches it only duplicated runs for same-repo branches. The tradeoff: PRs opened from forks no longer trigger a run, since fork pushes don't fire in the base repo. Worth adding back if this repo ever takes fork contributions.

"Can we test the current version always?" — yes, and it already does

This hinges on the jobs referencing the workflows by local path (./.github/workflows/security.yml) rather than @main. GitHub resolves a local reusable-workflow reference against the same commit as the caller, so a push to any branch exercises that branch's copy. Referencing @main would silently test the already-merged version and defeat the entire point.

I verified this rather than trusting the docs. Pushed a scratch branch containing a marker that existed only on that branch:

secret-scan / TruffleHog Secret Scan
  echo "MARKER_FROM_BRANCH_NOT_MAIN_9f3a2c"
  MARKER_FROM_BRANCH_NOT_MAIN_9f3a2c

The marker executed inside the secret-scan job — proving the called workflow came from the branch commit, not from main. Scratch branch has been deleted, and security.yml on this branch is byte-identical to main (the marker was never carried over).

So the practical effect: push a change to security.yml on a branch, and that branch's run tests the modified version before it can reach any consumer.

actionlint still passes clean across all four workflow files.