lint / check things

Author: craignuj

.github/workflows/deploy.yml

@@ -8,21 +8,19 @@ on:
 
 permissions:
   id-token: write
-  contents: write
+  contents: read
 
 jobs:
   build-deploy:
     strategy:
       matrix:
-        env: [dev, prod, test]
+        env: [dev, test, prod]
     name: Build Docker
     runs-on: ubuntu-latest
     environment: ${{ matrix.env }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
-        with:
-          ref: ${{ github.ref }}
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v5

.github/workflows/lint-workflows.yml

@@ -0,0 +1,26 @@
+name: Lint Workflows
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run actionlint
+        uses: rhysd/actionlint@v1
+
+  yamllint:
+    name: yamllint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run yamllint
+        run: yamllint .github/workflows/

.github/workflows/pr.yml

@@ -4,17 +4,18 @@ on:
   pull_request:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   docker-build:
     name: Build Docker
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
-        with:
-          ref: ${{ github.ref }}
 
-      - name: Build, tag, and push the image to Amazon ECR
+      - name: Build Docker image (local only)
         id: build-image
         env:
           ECR_REGISTRY: local.test

.yamllint.yml

@@ -0,0 +1,6 @@
+extends: default
+rules:
+  line-length:
+    max: 120
+  truthy:
+    allowed-values: ['true', 'false', 'on', 'off']