ci: consolidate workflow validation

.github/workflows/scan-github-actions.yml → .github/workflows/workflow-validation.yml

@@ -1,24 +1,28 @@
-name: Scan GitHub Actions
+name: Workflow Validation
 
 on:
   pull_request:
     paths:
       - ".github/**"
+      - ".pinact.yaml"
   push:
     branches:
       - main
     paths:
       - ".github/**"
+      - ".pinact.yaml"
   workflow_dispatch:
   schedule:
     - cron: "19 7 * * 1"
 
 permissions: {}
 
 jobs:
-  scan:
-    name: Scan GitHub Actions
-    uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@512158c4e90e42eef8aa7fc3fc3186a79b5b4648
+  workflow-validation:
+    name: Workflow Validation
+    uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@483bda4a2a4b5e04a51edff03768c1590d271f80 # main
     permissions:
       actions: read
       contents: read
+    with:
+      pinact: true

.pinact.yaml

@@ -0,0 +1,16 @@
+version: 3
+
+rules:
+  # Tempo's shared workflows are SHA-pinned but do not publish releases that
+  # pinact can use for version-comment or minimum-age verification.
+  - ignore: true
+    conditions:
+      - expr: |
+          ActionRepoFullName in ["tempoxyz/gh-actions", "tempoxyz/mpp-tools"]
+      - expr: ActionVersion matches "^[0-9a-f]{40}$"
+  # The changelog action may be pinned to an unreleased commit trusted by
+  # PyPI's OIDC publishing policy rather than to a release tag.
+  - ignore: true
+    conditions:
+      - expr: ActionName == "wevm/changelogs"
+      - expr: ActionVersion matches "^[0-9a-f]{40}$"