Repository navigation

ci: add ActionScope GitHub Actions security exposure scan #1

	name: ActionScope
	on:
	pull_request:
	paths:
	- ".github/actions/**"
	- ".github/workflows/**"
	- "*/.tf"
	- "*/.tf.json"
	- "*/iam*.json"
	- "*/policy*.json"
	push:
	branches:
	- master
	paths:
	- ".github/actions/**"
	- ".github/workflows/**"
	- "*/.tf"
	- "*/.tf.json"
	- "*/iam*.json"
	- "*/policy*.json"
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	scan:
	name: GitHub Actions security exposure
	runs-on: ubuntu-24.04
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Install ActionScope
	run: python3 -m pip install "actionscope>=0.3.5,<1.0"

	- name: Scan workflow exposure
	run: actionscope scan . --fail-on critical --no-color