Improvement: allowlist/specify files to check

[MPV]

Imagine if one has a "matrix" job which runs different checks for each workflow/action in your repository. Then it would be nice being able to use this action in a way where we pass/specify the exact path to the file(s) to check.

In the current implementation you're not allowed to pass your own glob string (path+file):

github-actions-ensure-sha-pinned-actions/src/index.js

Lines 14 to 15 in f324355

	const workflowsPath = process.env['ZG_WORKFLOWS_PATH'] || '.github/workflows';
	const globber = await glob.create([workflowsPath + '/*.yaml', workflowsPath + '/*.yml'].join('\n'));

There is the ZG_WORKFLOWS_PATH override, but how does one use it?

Also, there's still a hardcoded *.ya?ml glob, which disallows picking a specific file one-by-one.

[MPV]

For inspiration, see the RegEx that Renovate uses for finding GHA files:

{
  "fileMatch": [
    "^(workflow-templates|\\.(?:github|gitea|forgejo)/workflows)/[^/]+\\.ya?ml$",
    "(^|/)action\\.ya?ml$"
  ]
}

• https://docs.renovatebot.com/modules/manager/github-actions/#default-config