Ignore actionlint's false positive for job.workflow_sha and job.workflow_repository. Closes #139

[easylife-agents]

Closes #139.

actionlint 1.7.12 (the latest release) predates job.workflow_sha / job.workflow_repository, which pr_compliance.yml and pr_agent_review.yml use on purpose, so call-workflow-lint / actionlint fails on every pull request. This passes -ignore for exactly those two properties on the job context.

Verified

• Real actionlint 1.7.12 binary, locally, on the current tree (4 errors before): 0 errors with the ignore.
• Still reported with the ignore: job.nonexistent_thing, job.workflow_shax, job.my_workflow_repository.
• The exact docker://rhysd/actionlint step with this args block, on a throwaway branch in real Actions: passes (branch deleted). A first attempt with a quoted pattern failed there: the action splits args on whitespace and ignores quotes, which is why the pattern uses \s and \x22 and the comment says so.

This pull request's own call-workflow-lint / actionlint stays red until it merges, because pr-review.yml calls the reusable workflow at @main, which is still the old file. That is the expected state, and the throwaway-branch run above is the proof.

Changed after review

• 08b0944 answers the one WHITE finding: the pattern is anchored on the quoted property name, and the comment now says the {check_run_id tail is what scopes the ignore to the job context.
• 866aeb4 precedes the review: it is the quoting fix found by the real run, not new scope.

🤖 Generated with Claude Code

[plamber]

No blockers. One WHITE: the ignore is a little wider than its comment says.

	Finding	Where
⚪	Pattern is unanchored and \S* accepts trailing characters, so job.workflow_shax would also be ignored; comment says "exactly"	.github/workflows/workflow_lint.yml:57

Good: the final args form was run as the real docker step on a throwaway branch (the quoted first attempt failed there), and a genuinely undefined property is still reported.

---

Generated by Claude Code

[plamber]

⚪ Unanchored, and \S* accepts any trailing characters, so a typo like job.workflow_shax or job.my_workflow_repository is ignored too, which the comment's "exactly those two messages" denies. The {check_run_id tail limits it to the job context, so the blast radius is small. Anchor the property name with \x22 (RE2 escape, no quote character in the argument): property\s\x22workflow_(sha|repository)\x22\sis\snot\sdefined\sin\sobject\stype\s\{check_run_id, and say in the comment that the tail scopes it to the job context.