@@ -0,0 +1,29 @@
+name: moda-linter
+
+on:
+  pull_request:
+    branches-ignore: [main, master]
+
+jobs:
+  run-moda-linter:
+    if: github.repository == 'github/docs-internal'
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+    uses: github/internal-actions/.github/workflows/moda-linter.yml@main
+    secrets: inherit
+
+  # Reusable workflow checks are prefixed with the caller job name, but Heaven
+  # requires an exact "moda-linter" check context for branch deployments.
+  moda-linter:
+    permissions: {}
+    name: moda-linter
+    needs: run-moda-linter
+    if: ${{ always() && github.repository == 'github/docs-internal' }}
+    runs-on: ubuntu-slim
+    steps:
+      - name: Check moda-linter result
+        env:
+          RESULT: ${{ needs.run-moda-linter.result }}
+        run: test "$RESULT" = success
@@ -10,6 +10,8 @@ import { chain, get } from 'lodash-es'
 const githubOwnedActionsRegex =
   /^(actions\/(cache|checkout|download-artifact|upload-artifact)@v\d+(\.\d+)*)$/
 const actionHashRegexp = /^[A-Za-z0-9-/]+@[0-9a-f]{40}$/
+const internalReusableWorkflowRegexp =
+  /^github\/internal-actions\/\.github\/workflows\/[A-Za-z0-9_-]+\.ya?ml@main$/
 const checkoutRegexp = /^[actions/checkout]+@(v\d+(\.\d+)*|[0-9a-f]{40})$/
 const permissionsRegexp = /(read|write)/
 
@@ -125,7 +127,10 @@ describe('GitHub Actions workflows', () => {
   test.each(allUsedActions)('requires specific hash: %p', (actionName) => {
     const matchesGitHubOwnedActions = githubOwnedActionsRegex.test(actionName)
     const matchesActionHash = actionHashRegexp.test(actionName)
-    expect(matchesGitHubOwnedActions || matchesActionHash).toBe(true)
+    const matchesInternalReusableWorkflow = internalReusableWorkflowRegexp.test(actionName)
+    expect(matchesGitHubOwnedActions || matchesActionHash || matchesInternalReusableWorkflow).toBe(
+      true,
+    )
   })
 
   test.each(scheduledWorkflows)(