ci: lint workflow files with actionlint #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint Workflows | |
| # Lint the workflow files themselves. actionlint catches what YAML validity can't: | |
| # undefined `needs`/job references, bad `${{ }}` expressions, unknown action inputs, | |
| # and (via its shellcheck integration) shell issues in `run:` blocks. A broken | |
| # `needs:` reference once shipped silently because nothing here guarded it. | |
| on: | |
| pull_request: | |
| paths: | |
| - '.github/workflows/**' | |
| push: | |
| branches: [main] | |
| paths: | |
| - '.github/workflows/**' | |
| permissions: | |
| contents: read | |
| jobs: | |
| actionlint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Install actionlint | |
| # Pinned by version; the download is verified against the release's own | |
| # published checksums. taiki-e/install-action doesn't carry actionlint, and | |
| # curl|bash of an upstream script pins nothing — this does both. | |
| env: | |
| ACTIONLINT_VERSION: 1.7.12 | |
| run: | | |
| base="https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}" | |
| curl -fsSL "${base}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" -o actionlint.tar.gz | |
| curl -fsSL "${base}/actionlint_${ACTIONLINT_VERSION}_checksums.txt" -o checksums.txt | |
| grep "actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" checksums.txt | sha256sum -c - | |
| tar -xzf actionlint.tar.gz actionlint | |
| install -m 0755 actionlint /usr/local/bin/actionlint | |
| rm -f actionlint actionlint.tar.gz checksums.txt | |
| # shellcheck ships on the runner, so actionlint also lints embedded `run:` | |
| # scripts. -color for readable annotations in the job log. | |
| - name: Run actionlint | |
| run: actionlint -color |