From b14b3dfb7eb1f8d03b6e3f43d1363b5605493f12 Mon Sep 17 00:00:00 2001
From: Cherno Jagne <cherno@autar.ai>
Date: Tue, 28 Jul 2026 23:28:35 -0700
Subject: [PATCH] Add actionlint to CI and pre-commit hooks

Set up actionlint to lint GitHub Actions workflow files:
- .github/actionlint.yaml: config suppressing common GHA ShellCheck
  false positives (SC2086, SC2129, SC2155, SC1091).
- .github/workflows/actionlint.yml: dedicated CI job triggered on
  changes to workflow files.
- .pre-commit-config.yaml: actionlint hook for local validation.
---
 .github/actionlint.yaml          | 14 +++++++++++++
 .github/workflows/actionlint.yml | 34 ++++++++++++++++++++++++++++++++
 .pre-commit-config.yaml          |  4 ++++
 3 files changed, 52 insertions(+)
 create mode 100644 .github/actionlint.yaml
 create mode 100644 .github/workflows/actionlint.yml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 000000000..b722b6ebf
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,14 @@
+# actionlint configuration
+# https://github.com/rhysd/actionlint/blob/main/docs/config.md
+self-hosted-runner:
+  labels: []
+
+# ShellCheck rules disabled inside run: blocks.
+# Each `run:` block is checked through ShellCheck; suppress noisy rules here.
+paths:
+  ".github/workflows/**/*.{yml,yaml}":
+    ignore:
+      - 'shellcheck reported issue in this script: SC1091:.+'  # Can't follow non-constant source
+      - 'shellcheck reported issue in this script: SC2086:.+'  # Double-quote to prevent globbing/word splitting
+      - 'shellcheck reported issue in this script: SC2129:.+'  # Consider using { cmd1; cmd2; } >> file
+      - 'shellcheck reported issue in this script: SC2155:.+'  # Declare and assign separately to avoid masking return values
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
new file mode 100644
index 000000000..6b7a282a2
--- /dev/null
+++ b/.github/workflows/actionlint.yml
@@ -0,0 +1,34 @@
+name: Actionlint
+
+on:
+  push:
+    paths:
+      - '.github/workflows/**'
+      - '.github/actionlint.yaml'
+      - '.github/actionlint.yml'
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+      - '.github/actionlint.yaml'
+      - '.github/actionlint.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: actionlint-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Download actionlint
+        id: download
+        run: bash <(curl -sSf https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+        shell: bash
+      - name: Run actionlint
+        run: |
+          ./actionlint -color
+        shell: bash
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 7050fa3c9..6b970eede 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -11,3 +11,7 @@ repos:
     - id: bandit
       args: ["-c", "bandit.yaml"]
       additional_dependencies: ["bandit[yaml]"]
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.7
+    hooks:
+      - id: actionlint