refactor(ci): Refactoring CI workflows

.github/workflows/action-pin.yaml → .github/workflows/action_compliance.yaml

@@ -1,19 +1,29 @@
-name: Action Pin
+name: check action compliance
 
 on:
   pull_request:
+    paths:
+      - .github/workflows/**
   push:
     branches:
       - main
+      - 'release/*'
 
 jobs:
-  check-action-pin:
+  action-pin:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
-
       - name: Ensure SHA pinned actions
         uses: zgosalvez/github-actions-ensure-sha-pinned-actions@0901cf7b71c7ea6261ec69a3dc2bd3f9264f893e # v3.0.12
         with:
           allowlist: |
             slsa-framework/slsa-github-generator
+
+  action-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+
+      - name: actionlint
+        uses: raven-actions/actionlint@01fce4f43a270a612932cb1c64d40505a029f821 # v2.0.0

.github/workflows/block_merge.yml → .github/workflows/commit_compliance.yml

@@ -1,13 +1,14 @@
-# Check commit and PR compliance
-name: Check commit message compliance
+name: check commit compliance
 on:
   pull_request:
-    types: [opened, synchronize, reopened]
+  push:
+    branches:
+      - 'main'
+      - 'release/*'
 
 jobs:
-  check-commit-pr:
-    name: Check commit and PR
-    runs-on: ubuntu-20.04
+  format:
+    runs-on: ubuntu-latest
     steps:
       - name: Check first line
         uses: gsactions/commit-message-checker@16fa2d5de096ae0d35626443bcd24f1e756cafee # v2.0.0
@@ -19,3 +20,18 @@ jobs:
           excludeTitle: 'true' # optional: this excludes the title of a pull request
           checkAllCommitMessages: 'true' # optional: this checks all commits associated with a pull request
           accessToken: ${{ secrets.GITHUB_TOKEN }} # github access token is only required if checkAllCommitMessages is true
+
+  signatures:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check commit signatures
+        uses: 1Password/check-signed-commits-action@ed2885f3ed2577a4f5d3c3fe895432a557d23d52
+
+  linelint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Linelint
+        uses: fernandrone/linelint@8136e0fa9997122d80f5f793e0bb9a45e678fbb1 # 0.0.4
+        id: linelint