ci: lint workflows with actionlint - #17
Merged
Merged
Conversation
Adds a reusable `actionlint.yml` that lints GitHub Actions workflow YAML at a pinned upstream version. It also self-runs on this repo when PRs/pushes touch `.github/workflows/**` or `actions/**/action.yml`, catching syntax / expression / shell / `workflow_call` input-contract errors before they hit a caller as a runtime `startup_failure`. Closes the residual acceptance item from platform-gitops#540: > Add `actionlint` (or equivalent) on the calling workflow to catch > the kind of input-contract regression that dis #131 fixed. Service-template's `ci.yml` will reuse this workflow in a follow-up so new repos forked from the template inherit the check automatically. Refs: platform-gitops#944 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The first run flagged four shellcheck info/style findings (SC2295, SC2001, SC2129) in pre-existing `run:` blocks across chart-release, docker-release, and tag-config. They're real but minor stylistic nitpicks, not the input-contract regressions this gate is scoped to catch (platform-gitops#944). Pass `-S warning` via `SHELLCHECK_OPTS` so shellcheck still catches real bugs (quoting, word-splitting, exit-code mishandling) but stops blocking PRs on style. Tighten later by dropping the env var once the existing scripts are tidied up. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/actionlint.yml— a reusable workflow that runsactionlintat a pinned upstream version (v1.7.7)..github/workflows/**oractions/**/action.yml, so input-contract regressions in our reusable workflows are caught at PR time instead of surfacing in a caller as a runtimestartup_failure.README.mdand the static-lint guarantee inCLAUDE.md.Why
Closes the residual acceptance item from #540:
Refs platform-gitops#944.
Scope caveat
Stock
actionlintdoesn't fetch remote reusable workflows, so this PR alone can't cross-validate that a caller's input map matchespinpredict/.github'sworkflow_call.inputs:block. What it does catch:service-template).That's still a meaningful tightening over the status quo where any of these fail at runtime.
Test plan
workflow_call: {}and self-pull_request:/push:triggers scoped to workflow + action paths.download-actionlint.bashpinned byACTIONLINT_VERSION, no third-party JS marketplace actions.actionlintagainst all 5 workflows in this repo (the 4 existing + the new one) and is green.🤖 Generated with Claude Code