reformat-yaml.yml

--- # Reformatting Yaml
name: "Standardise: YAML format"

on:
  push:
    branches-ignore:
      - "release/*"
      - "hotfix/*"
    paths:
      - '**.yml'
      - '**.yaml'
      - '.github/workflows/reformat-yaml.yml'

concurrency:
  group: ${{github.workflow}}-${{github.ref}}
  cancel-in-progress: true

permissions:
  contents: write

jobs:
  standardise-yaml-files:

    if: |-
      github.event.pull_request.draft == false
      && ( !startsWith(github.head_ref, 'release/')
      && !startsWith(github.head_ref, 'hotfix/') )
      && github.actor != 'dependabot[bot]'
    runs-on: [self-hosted, linux]

    steps:
      - name: "Initialise Workspace"
        if: startsWith(runner.name, 'buildagent-')
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"

      - name: "Harden Security"
        uses: step-security/harden-runner@v2.7.0
        with:
          egress-policy: audit
          disable-sudo: true
          allowed-endpoints: >
            api.github.com:443
            api.osv.dev:443
            api.securityscorecards.dev:443
            codeload.github.com:443
            fulcio.sigstore.dev:443
            github.com:443
            oss-fuzz-build-logs.storage.googleapis.com:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443
            www.bestpractices.dev:443

      - name: "Checkout Source"
        uses: actions/checkout@v4.1.1
        with:
          fetch-depth: 0
          fetch-tags: true
          token: ${{secrets.SOURCE_PUSH_TOKEN}}

      - name: "Reformat"
        uses: credfeto/action-yaml-format@v1.3.2

      - name: "Commit Changes"
        uses: stefanzweifel/git-auto-commit-action@v5.0.1
        with:
          commit_message: "[Reformat] YAML Files to common format"
          file_pattern: "*.yml"
          commit_user_name: "fun-ymlfmt[bot]"
          commit_user_email: "credfeto@users.noreply.github.com"
          commit_author: "fun-ymlfmt[bot] <credfeto@users.noreply.github.com>"
          skip_dirty_check: false