name: Scan GitHub Actions
on:
# Required checks must report for every PR, including source-only changes.
pull_request:
merge_group:
push:
branches:
- main
paths:
- ".github/**"
workflow_dispatch:
schedule:
- cron: "19 7 * * 1"
permissions:
jobs:
scan:
name: Scan GitHub Actions
uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@947d9a3ccb2425a9c94d563fd721cc0e33c89e26 # 2026-10-15T00-15-06Z-947d9a3c
permissions:
id-token: write
actions: read
contents: read