Merge pull request #213 from loss-and-quick/ci/nightly-module-nix #109
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint Workflows | |
| # Lint the workflow files themselves. actionlint catches what YAML validity can't: | |
| # undefined `needs`/job references, bad `${{ }}` expressions, unknown action inputs, | |
| # and (via its shellcheck integration) shell issues in `run:` blocks. A broken | |
| # `needs:` reference once shipped silently because nothing here guarded it. | |
| on: | |
| pull_request: | |
| paths: | |
| - '.github/workflows/**' | |
| push: | |
| branches: [main] | |
| paths: | |
| - '.github/workflows/**' | |
| permissions: | |
| contents: read | |
| jobs: | |
| actionlint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Install actionlint | |
| # Pinned by version; the download is verified against the release's own | |
| # published checksums. taiki-e/install-action doesn't carry actionlint, and | |
| # curl|bash of an upstream script pins nothing — this does both. | |
| env: | |
| ACTIONLINT_VERSION: 1.7.12 | |
| run: | | |
| tarball="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" | |
| base="https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}" | |
| # Keep the release filename so the checksum line resolves to it. | |
| curl -fsSL "${base}/${tarball}" -o "${tarball}" | |
| curl -fsSL "${base}/actionlint_${ACTIONLINT_VERSION}_checksums.txt" -o checksums.txt | |
| grep " ${tarball}\$" checksums.txt | sha256sum -c - | |
| tar -xzf "${tarball}" actionlint | |
| install -m 0755 actionlint /usr/local/bin/actionlint | |
| rm -f actionlint "${tarball}" checksums.txt | |
| # shellcheck ships on the runner, so actionlint also lints embedded `run:` | |
| # scripts. -color for readable annotations in the job log. | |
| - name: Run actionlint | |
| run: actionlint -color |