name: validate
on:
  pull_request:
  push:
    branches: [production]
  workflow_dispatch:

jobs:
  validate:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Audit egress
        continue-on-error: true
        uses: bullfrogsec/bullfrog@7bc9b6e13e2dd9cbe5861f33bc26dc6bdb9d9ed2   # v0.10.0
        with:
          egress-policy: audit
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
        with:
          persist-credentials: false
      - name: Validate codecov.yml structure
        run: |
          set -euo pipefail
          curl -sS --fail-with-body -X POST \
            --connect-timeout 10 --max-time 60 \
            --data-binary @codecov.yml \
            https://codecov.io/validate