feat: add actionlint to CI and pre-commit for workflow validation

.github/workflows/code-quality.yml

@@ -38,6 +38,13 @@ jobs:
         run: ruff format --check .
 
       - name: Markdownlint
+        # v23.0.0 bundles markdownlint-cli2 0.22.1 — keep in sync with .pre-commit-config.yaml
         uses: DavidAnson/markdownlint-cli2-action@ce4853d43830c74c1753b39f3cf40f71c2031eb9  # v23.0.0
         with:
           globs: "**/*.md"
+
+      - name: Actionlint
+        # shellcheck is pre-installed on ubuntu-latest, so run: steps are also linted
+        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8  # v2.1.2
+        with:
+          version: 1.7.12

.pre-commit-config.yaml

@@ -58,3 +58,11 @@ repos:
     hooks:
       - id: markdownlint-cli2
         args: [--fix]
+
+  # Actionlint — GitHub Actions workflow validation
+  # Keep version in sync with raven-actions/actionlint in .github/workflows/code-quality.yml
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.12
+    hooks:
+      - id: actionlint
+        files: ^\.github/workflows/

CONTRIBUTING.md

@@ -69,33 +69,15 @@ General-purpose checks from [pre-commit/pre-commit-hooks](https://github.com/pre
 | `no-commit-to-branch` | Blocks direct commits to `main` |
 | `detect-private-key` | Catches accidentally committed private keys |
 
-## Linting and formatting
-
-This project uses [ruff](https://docs.astral.sh/ruff/) for Python linting and formatting, and [markdownlint](https://github.com/DavidAnson/markdownlint) for Markdown linting. Both run as blocking CI checks on all pull requests via the `Code Quality` workflow.
-
-### Python (ruff)
+### GitHub Actions workflow validation (actionlint)
 
-Run locally before pushing:
-
-```bash
-uv tool install ruff==0.15.11
-ruff check .          # lint
-ruff format --check . # format check
-ruff format .         # auto-format
-```
+Validates `.github/workflows/` files using [actionlint](https://github.com/rhysd/actionlint). Only runs when workflow files are staged.
 
-Configuration is in [`ruff.toml`](ruff.toml) at the repo root.
-
-### Markdown (markdownlint)
-
-Run locally before pushing:
+## Linting and formatting
 
-```bash
-npx markdownlint-cli2@0.22.1 "**/*.md"          # lint
-npx markdownlint-cli2@0.22.1 --fix "**/*.md"    # auto-fix
-```
+This project uses [ruff](https://docs.astral.sh/ruff/) for Python linting and formatting, [markdownlint](https://github.com/DavidAnson/markdownlint) for Markdown linting, and [actionlint](https://github.com/rhysd/actionlint) for GitHub Actions workflow validation. All three run as blocking CI checks on every pull request via the `Code Quality` workflow, and locally via the [pre-commit hooks](#pre-commit-hooks) described above.
 
-Configuration is in [`.markdownlint.jsonc`](.markdownlint.jsonc) (rules) and [`.markdownlint-cli2.yaml`](.markdownlint-cli2.yaml) (ignored paths) at the repo root.
+Configuration files: [`ruff.toml`](ruff.toml) (Python rules), [`.markdownlint.jsonc`](.markdownlint.jsonc) (Markdown rules), [`.markdownlint-cli2.yaml`](.markdownlint-cli2.yaml) (ignored paths).
 
 ## Commit message conventions