BAU: Add Dependabot validation workflow

Also, add a pre-commit hook to check that the GHA pinning is correct.
govuk-one-login · Jul 18, 2024 · c226d83 · c226d83
1 parent 5d9de2f
commit c226d83
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 0 deletions.
diff --git a/.github/workflows/dependabot-validate.yml b/.github/workflows/dependabot-validate.yml
@@ -0,0 +1,15 @@
+name: Validate Dependabot
+
+on:
+  pull_request:
+    paths:
+      - ".github/dependabot.yml"
+      - ".github/workflows/dependabot-validate.yml"
+jobs:
+  validate:
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: marocchino/validate-dependabot@d8ae5c0d03dd75fbd0ad5f8ab4ba8101ebbd4b37 # v3.0.0
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -27,6 +27,13 @@ repos:
     hooks:
       - id: actionlint
 
+  - repo: https://github.com/lalten/check-gha-pinning
+    rev: v1.1.0
+    hooks:
+      - id: check-gha-pinning
+        # Skip git check for now until subdirectory support is added (#1)
+        entry: env GHA_PINNING_SKIP_GIT_CHECK=1 check-gha-pinning
+
   - repo: local
     hooks:
       - id: eslint