#69 add linter workflow and update permissions

.github/workflows/add-labels-to-issue.yaml

@@ -8,6 +8,9 @@ on:
       SENZING_MEMBERS:
         required: false
 
+permissions:
+  issues: write
+
 jobs:
 
   add-customer-submission-label:

.github/workflows/issue-automation.yaml

@@ -3,8 +3,8 @@ name: 'issue automation'
 on:
   issues:
     types:
-      - reopened
       - opened
+      - reopened
 
 jobs:
 

.github/workflows/lint-workflows.yaml

@@ -0,0 +1,54 @@
+name: 'lint workflows'
+
+on:
+  workflow_call:
+    inputs:
+      validate-all-codebase:
+        default: false
+        description: 'Lint all files or only modified: true/false.'
+        required: false
+        type: boolean
+
+permissions:
+  contents: read
+  packages: read
+  statuses: write
+
+jobs:
+  # In order to require linting as a status check we need to
+  # run the overall workflow on every pr.
+  # This is used to skip at the job level if there are no
+  # changes to the workflow files.
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      workflows: ${{ steps.changes.outputs.workflows }}
+    steps:
+      - uses: actions/checkout@v3
+      - uses: dorny/paths-filter@v2
+        id: changes
+        with:
+          filters: |
+            workflows:
+              - '.github/workflows/**'
+
+  lint-workflows:
+    name: Lint Workflows
+    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ needs.changes.outputs.workflows == 'true' }}
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Lint Code Base
+        uses: github/super-linter@v5
+        env:
+          DEFAULT_BRANCH: main
+          FILTER_REGEX_INCLUDE: .*.github/workflows/.*
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # only lint new and modified files
+          VALIDATE_ALL_CODEBASE: false