ci: install CI dependencies from hash-pinned locks (#50) #6

	name: Workflow lint

	# actionlint catches what a YAML parser cannot: duplicate mapping keys that
	# make GitHub refuse to load a workflow, invalid ${{ }} expressions, and shell
	# problems inside run: blocks. A duplicate env: key silently broke this repo
	# family's release workflow once; yaml.safe_load keeps the last value without
	# complaining, so local validation passed while Actions rejected the file.
	on:
	push:
	branches: [main]
	paths: ['.github/workflows/**']
	pull_request:
	paths: ['.github/workflows/**']
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	actionlint:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	# Fetched and checksum-verified rather than run as a third-party action,
	# so this check adds no new action to the supply chain it exists to guard.
	- name: Install actionlint
	env:
	ACTIONLINT_VERSION: 1.7.12
	ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
	run: \|
	set -euo pipefail
	archive="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
	curl -sSfL -o "$archive" \
	"https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/${archive}"
	echo "${ACTIONLINT_SHA256} ${archive}" \| sha256sum -c -
	tar -xzf "$archive" actionlint
	install -m 0755 actionlint /usr/local/bin/actionlint

	- name: Lint workflows
	run: actionlint -color

Navigation Menu