action-lint.yaml

name: Actionlint
# Validate the GitHub Actions workflow files. The other PR checks don't verify
# that a workflow is actually runnable, so a malformed one (e.g. an invalid job
# id) can merge green and only fail at startup on main. actionlint catches that
# class at PR time. shellcheck integration is disabled (-shellcheck=) to keep
# the gate focused on workflow validity; drop that flag to also lint run: shell.
#
# Pull requests only, and not while the PR is a draft; the PR run covers what
# merges, so nothing reruns on push to main.
on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened, ready_for_review]
# One run per PR per workflow: a new push cancels the older PR run.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true
permissions:
  contents: read
jobs:
  actionlint:
    name: 🧹 Actionlint
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      # The pinned release binary, checked against the SHA-256 the release
      # publishes, instead of compiling actionlint@latest with Go on every run.
      # Update ACTIONLINT_SHA256 together with ACTIONLINT_VERSION (from the
      # release's actionlint_<version>_checksums.txt).
      - name: 📦 Install actionlint
        env:
          ACTIONLINT_VERSION: 1.7.12
          ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
        run: |
          set -euo pipefail
          tarball="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          curl -sSfL -o "$RUNNER_TEMP/$tarball" \
            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/${tarball}"
          echo "${ACTIONLINT_SHA256}  $RUNNER_TEMP/$tarball" | sha256sum -c -
          mkdir -p "$RUNNER_TEMP/actionlint"
          tar -xzf "$RUNNER_TEMP/$tarball" -C "$RUNNER_TEMP/actionlint" actionlint
          echo "$RUNNER_TEMP/actionlint" >> "$GITHUB_PATH"
      - name: 🧹 Run actionlint
        run: actionlint -color -shellcheck=