ci(lint): add checks: write + fix path filter on actionlint workflow#373
Merged
ci(lint): add checks: write + fix path filter on actionlint workflow#373
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a dedicated GitHub Actions workflow to statically lint other workflows using actionlint (via reviewdog/action-actionlint), to catch common GitHub Actions YAML issues and ShellCheck findings in run: blocks early during PR review.
Changes:
- Introduce
.github/workflows/lint.ymlto run actionlint on workflow/config changes only (path-filtered). - Configure reviewdog reporting via Checks API annotations and fail the workflow on any finding.
- Apply least-privilege permissions at workflow/job level and pin actions to SHAs.
Reworked from the original "create lint.yml" form (#373 v1) to a modification of the existing lint.yml that #370 introduced. Functional changes vs. main: 1. permissions: + `checks: write` — required for reviewdog's `github-pr-check` reporter to publish inline annotations via the Checks API. Without it, findings only show up in the run log, not on the PR diff (silent degradation). 2. paths filter: `.github/actions/**` → `.github/actionlint.yaml`. actionlint's default invocation does NOT lint composite actions under `.github/actions/`, so the previous filter triggered the workflow on changes that never affected lint output. The new filter tracks the actionlint config (which DOES affect lint results). 3. Documentation: caveats around `set -euo pipefail` × `$(... | jq ...)` exit-propagation gaps, composite-action coverage, and per-setting rationale. Synced from `vuls-saas/vuls-reach` PR #9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
kotakanbe
force-pushed
the
ci/actionlint-workflow
branch
from
0ed59de to
90bb41f
Compare
kotakanbe
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reworked from the original "create
lint.yml" form to a modification of the existinglint.ymlthat #370 introduced. Three functional changes versus currentmain.Functional changes vs. main
1.
permissions:— addchecks: writeRequired for reviewdog's
github-pr-checkreporter to publish inline annotations via the Checks API. Without it, findings only appear in the run log, not on the PR diff — a silent degradation that defeats the point of thegithub-pr-checkreporter.2.
paths:—.github/actions/**→.github/actionlint.yamlactionlint's default invocation does not lint composite actions under
.github/actions/, so the previous path filter triggered the workflow on changes that never affected lint output. The new filter tracks the actionlint config file (which DOES affect lint results when it exists).A note in the file header documents that composite actions need explicit
actionlint_flagspaths if they are added in the future.3. Documentation
set -euo pipefail×var=$(... | jq ...)exit-propagation gap that shellcheck does not model — referenced as|| trueguard pattern incopilot-clean-label.ymlstuck-detector.checks: write, the v1.72.0 SHA pin, andactionlint_flags: -color.Synced from
vuls-saas/vuls-reachPR #9.Test plan
git diff origin/mainis a pure modification (no add/add file conflict)checks: write).github/actionlint.yamlis touched (currently absent — can be tested by adding an empty config).github/actions/**changes (no composite actions exist yet, so this is a no-op verification — leave a TODO for when one is added)🤖 Generated with Claude Code