Lint

Add SAST with Octoscan #88

	# yaml-language-server: $schema=https://json.schemastore.org/github-workflow

	name: Lint
	on:
	pull_request:
	paths:
	# Only run when changes are made to workflow files.
	- '.github/workflows/**'
	push:
	branches:
	- trunk
	paths:
	# Only run when changes are made to workflow files.
	- '.github/workflows/**'

	permissions: {}

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	actionlint:
	name: Actionlint
	runs-on: ubuntu-24.04
	permissions:
	contents: read
	timeout-minutes: 1
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Run actionlint
	uses: docker://rhysd/actionlint:latest
	with:
	args: "-color -verbose -shellcheck="

	octoscan:
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	actions: read
	contents: read
	timeout-minutes: 10
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Run octoscan
	id: octoscan
	uses: synacktiv/action-octoscan@v1

	- name: Upload SARIF file to GitHub
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: "${{steps.octoscan.outputs.sarif_output}}"
	category: octoscan

Provide feedback