From 8bbbc732765c3e7d68bebefe72e0220b7c7213b6 Mon Sep 17 00:00:00 2001
From: Thomas Luizon Rodrigues Gregorio <thomaslrgregorio@gmail.com>
Date: Sat, 3 Oct 2026 16:07:12 -0300
Subject: [PATCH 1/2] fix: remove duplicate workflow keys and guard workflow
 syntax

---
 .github/workflows/dependency-review.yml |  8 --------
 .github/workflows/guards.yml            | 14 ++++++++++++++
 .github/workflows/sonarcloud.yml        |  8 --------
 3 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index d8001f491..6a489f9ae 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -8,14 +8,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
   contents: read
 
diff --git a/.github/workflows/guards.yml b/.github/workflows/guards.yml
index fee7588c2..f3d121b48 100644
--- a/.github/workflows/guards.yml
+++ b/.github/workflows/guards.yml
@@ -18,6 +18,20 @@ permissions:
   pull-requests: read
 
 jobs:
+  workflows:
+    name: Workflow Syntax
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Check workflow files
+        shell: bash
+        # https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#concurrency documents queue, which actionlint does not recognize.
+        run: |
+          lint_dir="$(mktemp -d)"
+          curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash -o "$lint_dir/download-actionlint.bash"
+          bash "$lint_dir/download-actionlint.bash" 1.7.12 "$lint_dir"
+          "$lint_dir/actionlint" -color -ignore '^unexpected key "queue" for "concurrency" section\. expected one of "cancel-in-progress", "group"$'
+
   timeless:
     name: Timeless Text
     runs-on: ubuntu-latest
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index 8dddacea6..2a400375c 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -10,14 +10,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
   contents: read
 

From 2ed1e1dde2c09e7e1e00a0a148e57ee8556977c1 Mon Sep 17 00:00:00 2001
From: Thomas Luizon Rodrigues Gregorio <thomaslrgregorio@gmail.com>
Date: Sat, 3 Oct 2026 16:20:54 -0300
Subject: [PATCH 2/2] fix: enforce HTTPS on the actionlint download

SonarCloud rule githubactions:S6506 flagged the curl download in the workflow
syntax guard because a redirect could reach plain HTTP. Restrict the protocol
to HTTPS and TLS 1.2 or newer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/guards.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/guards.yml b/.github/workflows/guards.yml
index f3d121b48..1ecb572fd 100644
--- a/.github/workflows/guards.yml
+++ b/.github/workflows/guards.yml
@@ -28,7 +28,7 @@ jobs:
         # https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#concurrency documents queue, which actionlint does not recognize.
         run: |
           lint_dir="$(mktemp -d)"
-          curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash -o "$lint_dir/download-actionlint.bash"
+          curl --proto '=https' --tlsv1.2 -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash -o "$lint_dir/download-actionlint.bash"
           bash "$lint_dir/download-actionlint.bash" 1.7.12 "$lint_dir"
           "$lint_dir/actionlint" -color -ignore '^unexpected key "queue" for "concurrency" section\. expected one of "cancel-in-progress", "group"$'