action.yml: reformat comments-before

[thypon]

No description provided.

[github-actions]

[puLL-Merge] - brave/security-action@580

Description

This PR cleans up YAML formatting and syntax across various GitHub Actions workflows and Semgrep rules. It also adds a new lint GitHub Actions workflow to lint and audit the JavaScript code. The motivation seems to be to improve code quality and consistency.

Changes

Changes

• .github/workflows/*.yml: Cleaned up YAML formatting and syntax across multiple workflow files.
• action.yml: Cleaned up YAML formatting. Extracted some GitHub API calls into separate JavaScript modules.
• assets/reviewdog/reviewdog.yml: Cleaned up some multi-line strings.
• assets/semgrep_rules/**/*.yaml: Cleaned up YAML formatting and long lines across multiple Semgrep rule files.
• .github/workflows/lint.yml: Added a new workflow to lint and audit the JavaScript code on push/PRs to main branch.
• package.json: Added lint and lint-fix npm scripts. Added standard as a dev dependency.
• run.js, src/*.js: Linted all the JavaScript files.

Security Hotspots

1. action.yml: The extraction of GitHub API calls into separate modules slightly increases the attack surface, as untrusted data passed to those modules needs to be validated. However, the risk is relatively low.
2. assets/semgrep_rules/**/*.yaml: Changes to Semgrep rules can potentially weaken the static analysis security checks if not reviewed carefully. However, the changes here look like just formatting cleanup.
3. .github/workflows/lint.yml: The new linting workflow has access to GitHub Actions secrets. Need to ensure it doesn't leak them in logs or artifacts.

Overall, while this PR touches many security-sensitive files, the changes look like code cleanup and hardening with low risk. Still, it deserves a careful review given the breadth of changes. Let me know if you would like me to elaborate on any part of the review!