feat: add actionlint gha

Author: Demonsthere

.deps/actionlint.yaml

@@ -0,0 +1,3 @@
+version: 1.7.7
+url: https://github.com/rhysd/actionlint/releases/download/v{{.Version}}/actionlint_{{.Version}}_{{.Os}}_{{.Architecture}}.tar.gz
+mappings: {}

.github/workflows/ci.yaml

@@ -80,8 +80,7 @@ jobs:
           FORCE_FULL_RUN:
             ${{ github.ref_type == 'tag' ||
             steps.filter.outputs['cicd-definitions'] == 'true' ||
-            steps.filter.outputs['cicd-scripts'] == 'true'
-          }}
+            steps.filter.outputs['cicd-scripts'] == 'true'}}
         shell: bash
         run: |
           updated_charts=$(echo "$FILTER_OUTPUT" | jq -r 'to_entries | map(select((.key | endswith("-helm")) and .value == "true")) | map(.key)')

.github/workflows/gha-lint.yaml

@@ -0,0 +1,32 @@
+name: Validation - GHA Linter
+on:
+  merge_group:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - master
+
+jobs:
+  validate:
+    name: Validate GHA
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          base: master
+          filters: |
+            workflows:
+              - '.github/**'
+      - name: Setup dependencies
+        if: ${{ steps.filter.outputs.workflows == 'true' }}
+        run: |
+          make .bin/actionlint
+      - name: Make lint
+        if: ${{ steps.filter.outputs.workflows == 'true' }}
+        run: |
+          make gha-lint

Makefile

@@ -28,7 +28,7 @@ export VERSION=$(shell echo ${RELEASE_VERSION} | sed s/v//g)
 export K3SIMAGE := docker.io/rancher/k3s:v1.32.1-k3s1
 
 .bin/helm: Makefile
-	HELM_INSTALL_DIR=.bin bash <(curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3) -v v3.17.0 --no-sudo
+	HELM_INSTALL_DIR=.bin bash <(curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3) -v v3.17.2 --no-sudo
 
 .bin/yq: .deps/yq.yaml .bin/ory
 ifeq ($(BREW),true)
@@ -71,8 +71,20 @@ endif
 	curl -Lo .bin/kubectl $${URL}; \
 	chmod +x .bin/kubectl;
 
+.bin/actionlint: .deps/actionlint.yaml .bin/ory
+ifeq ($(BREW),true)
+		@echo "actionlint Provided by brew!"
+		@echo "${BREW_FORMULA}" | grep actionlint 1>/dev/null || brew install actionlint
+else
+		@URL=$$(.bin/ory dev ci deps url -o ${OS} -a ${ARCH} -c .deps/actionlint.yaml); \
+		echo "Downloading 'actionlint' $${URL}...."; \
+		curl -L $${URL} | tar -xmz -C .bin actionlint; \
+		echo; \
+		chmod +x .bin/actionlint;
+endif
+
 .PHONY: deps
-deps: .bin/ory .bin/helm .bin/yq .bin/helm-docs .bin/k3d .bin/kubectl
+deps: .bin/ory .bin/helm .bin/yq .bin/helm-docs .bin/k3d .bin/kubectl .bin/actionlint
 
 .PHONY: release
 release: ory-repo .bin/yq
@@ -168,6 +180,11 @@ format: .bin/goimports .bin/ory node_modules
 	.bin/goimports -w .
 	npm exec -- prettier --write .
 
+.PHONY: gha-lint
+gha-lint:
+	actionlint -version
+	actionlint -color -verbose
+
 licenses: .bin/licenses node_modules  # checks open-source licenses
 	.bin/licenses