Add some more lint/format checks.

.github/workflows/markdown_format.yml

@@ -16,4 +16,4 @@ jobs:
         uses: 'actions/checkout@v4'
 
       - name: 'Check Markdown Format'
-        run: 'pipx run mdformat --check --wrap 100 .'
+        run: 'tools/mdformat --check --wrap 100 .'

.github/workflows/yaml_format.yml

@@ -0,0 +1,20 @@
+### Ensure that Yaml files are properly formatted
+name: 'Check Yaml Format'
+
+on:
+  pull_request: 
+    paths:
+      - '**.yml'
+      - '**.yaml'
+
+jobs:
+  yamlfmt:
+    name: 'yamlfmt'
+    runs-on: 'ubuntu-latest'
+
+    steps:
+      - name: 'Checkout Code'
+        uses: 'actions/checkout@v4'
+
+      - name: 'Check Yaml Format'
+        run: 'tools/yamlfmt --lint --dstar "**/*.yaml"'

.yamlfmt

@@ -0,0 +1,3 @@
+formatter:
+  lines: 100
+

semgrep-rules/actions/pull_request_target_needs_exception.yaml

@@ -7,9 +7,9 @@ rules:
     metadata:
       category: best-practice
       technology:
-        - github-actions      
+        - github-actions
     patterns:
       - pattern-either:
           - patterns:
               - pattern-inside: "{on: ...}"
-              - pattern: pull_request_target
+              - pattern: pull_request_target

semgrep-tests/actions/pull_request_target_needs_exception.test.yaml

@@ -1,3 +1,3 @@
 on:
   # ruleid: pull-request-target-needs-exception
-  pull_request_target:
+  pull_request_target:

tools/mdformat

@@ -0,0 +1,2 @@
+#!/bin/sh
+pipx run mdformat $*

tools/yamlfmt

@@ -0,0 +1,2 @@
+#!/bin/sh
+docker run -v "$(pwd):/project" ghcr.io/google/yamlfmt:latest $*