From cfb17a6c26643647a5c7c009063c616c35ca4ce5 Mon Sep 17 00:00:00 2001
From: Claude Code Bot <claude-code@smartwatermelon.github>
Date: Thu, 29 Oct 2026 11:54:31 -0700
Subject: [PATCH 1/2] ci(self-review): run the test suite on every PR

tests/run-tests.sh ran in no workflow, so changes to the reusable
workflows were tested only on the author's machine. #206 changed the
Dependabot merge gate with 31 local-only tests. Add a tests job to
self-review.yml so the suite runs before a tag moves.

Advances smartwatermelon/dev-env#229
---
 .github/workflows/self-review.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.github/workflows/self-review.yml b/.github/workflows/self-review.yml
index 29b84f1..4e8fa7d 100644
--- a/.github/workflows/self-review.yml
+++ b/.github/workflows/self-review.yml
@@ -60,3 +60,18 @@ jobs:
 
       - name: Compare with dotfiles markdownlint-cli/.markdownlint.json
         run: bash tests/test-markdownlint-drift.sh
+
+  tests:
+    # Every tests/test-*.sh, so a change to a reusable workflow is tested before its tag moves.
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Run the test suite
+        run: bash tests/run-tests.sh

From 485809517732061be53b9a9104608688ba3eb763 Mon Sep 17 00:00:00 2001
From: Claude Code Bot <claude-code@smartwatermelon.github>
Date: Thu, 29 Oct 2026 11:56:26 -0700
Subject: [PATCH 2/2] ci(self-review): install the linters the test suite needs

The suite calls shellcheck, actionlint, zizmor, yamllint and
markdownlint-cli2 (CLAUDE.md). Install the same SHA-verified pins as
standards-check.yml, and add self-review.yml to zizmor's adhoc-packages
ignore for the same reason standards-check.yml is there.
---
 .github/workflows/self-review.yml | 34 +++++++++++++++++++++++++++++++
 zizmor.yml                        |  2 ++
 2 files changed, 36 insertions(+)

diff --git a/.github/workflows/self-review.yml b/.github/workflows/self-review.yml
index 4e8fa7d..87a0ad8 100644
--- a/.github/workflows/self-review.yml
+++ b/.github/workflows/self-review.yml
@@ -66,6 +66,16 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    # Same pins as standards-check.yml; change both together.
+    env:
+      SHELLCHECK_VERSION: "0.11.0"
+      SHELLCHECK_SHA256: "8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198"
+      ACTIONLINT_VERSION: "1.7.12"
+      ACTIONLINT_SHA256: "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8"
+      ZIZMOR_VERSION: "1.30.0"
+      ZIZMOR_SHA256: "ec8c95cd800845abb9bbc5f377ec7c57d2eb8e2386a00a201d3a74ee4092e5ed"
+      YAMLLINT_VERSION: "1.38.0"
+      MARKDOWNLINT_CLI2_VERSION: "0.23.2"
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -73,5 +83,29 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
+      - name: Install pinned linters
+        run: |
+          set -euo pipefail
+          mkdir -p "${HOME}/.local/bin"; echo "${HOME}/.local/bin" >> "${GITHUB_PATH}"
+          curl -Lfso /tmp/shellcheck.tar.xz \
+            "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
+          echo "${SHELLCHECK_SHA256}  /tmp/shellcheck.tar.xz" | sha256sum -c -
+          tar -xJf /tmp/shellcheck.tar.xz -C /tmp
+          install -m 0755 "/tmp/shellcheck-v${SHELLCHECK_VERSION}/shellcheck" "${HOME}/.local/bin/shellcheck"
+          curl -Lfso /tmp/actionlint.tar.gz \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          echo "${ACTIONLINT_SHA256}  /tmp/actionlint.tar.gz" | sha256sum -c -
+          tar -xzf /tmp/actionlint.tar.gz -C /tmp actionlint
+          install -m 0755 /tmp/actionlint "${HOME}/.local/bin/actionlint"
+          curl -Lfso /tmp/zizmor.tar.gz \
+            "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz"
+          echo "${ZIZMOR_SHA256}  /tmp/zizmor.tar.gz" | sha256sum -c -
+          mkdir -p /tmp/zizmor && tar -xzf /tmp/zizmor.tar.gz -C /tmp/zizmor
+          install -m 0755 "$(find /tmp/zizmor -type f -name zizmor | head -1)" "${HOME}/.local/bin/zizmor"
+          pipx install "yamllint==${YAMLLINT_VERSION}"
+          npm install -g "markdownlint-cli2@${MARKDOWNLINT_CLI2_VERSION}"
+          # yq and jq come with the runner image.
+          yq --version && jq --version
+
       - name: Run the test suite
         run: bash tests/run-tests.sh
diff --git a/zizmor.yml b/zizmor.yml
index b45bcd4..c992989 100644
--- a/zizmor.yml
+++ b/zizmor.yml
@@ -117,6 +117,8 @@ rules:
   # YAMLLINT_VERSION), and the three binary downloads next to them are
   # additionally SHA256-verified. A lockfile would add a second place for the
   # version to drift without removing the install.
+  # self-review.yml's tests job installs the same pins.
   adhoc-packages:
     ignore:
       - standards-check.yml
+      - self-review.yml