ci: add actionlint for GitHub Actions workflow linting (#226)

Author: deviantintegral

.claude/hooks/SessionStart.sh

@@ -65,6 +65,38 @@ fi
 
 composer install
 
+# Install shellcheck for shell script linting (used by actionlint)
+echo "Checking for shellcheck..."
+if ! command -v shellcheck &> /dev/null; then
+    echo "shellcheck is not installed. Installing shellcheck..."
+
+    if command -v apt-get &> /dev/null; then
+        apt-get install -y shellcheck
+    else
+        echo "Error: apt package manager is not available. Cannot install shellcheck."
+        exit 1
+    fi
+
+    if ! command -v shellcheck &> /dev/null; then
+        echo "Error: Failed to install shellcheck."
+        exit 1
+    fi
+
+    echo "shellcheck installed successfully!"
+else
+    echo "shellcheck is already available."
+fi
+
+# Install actionlint for GitHub Actions workflow linting
+echo "Checking for actionlint..."
+if ! command -v actionlint &> /dev/null && [ ! -f "./actionlint" ]; then
+    echo "actionlint is not installed. Downloading actionlint..."
+    bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/v1.7.9/scripts/download-actionlint.bash) 1.7.9
+    echo "actionlint installed successfully!"
+else
+    echo "actionlint is already available."
+fi
+
 # Install infection for mutation testing
 echo "Checking for infection..."
 if [ ! -f "infection.phar" ]; then

.github/workflows/actionlint.yml

@@ -0,0 +1,23 @@
+name: Lint GitHub Actions workflows
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: Download actionlint
+        id: get_actionlint
+        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/v1.7.9/scripts/download-actionlint.bash) 1.7.9
+        shell: bash
+      - name: Check workflow files
+        run: ${{ steps.get_actionlint.outputs.executable }} -color
+        shell: bash

.github/workflows/release-please.yml

@@ -44,7 +44,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
 
       - name: Cache dependencies
         uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5

.github/workflows/test.yml

@@ -31,7 +31,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
 
       - name: Cache dependencies
         uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
@@ -83,7 +83,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
 
       - name: Cache dependencies
         uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
@@ -114,7 +114,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
 
       - name: Cache dependencies
         uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
@@ -147,7 +147,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
 
       - name: Cache dependencies
         uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5

.gitignore

@@ -14,3 +14,4 @@ infection.phar.asc
 *.har
 infection*.txt
 infection-report.html
+actionlint

.pre-commit-config.yaml

@@ -8,6 +8,10 @@ repos:
       - id: check-added-large-files
       - id: check-merge-conflict
       - id: detect-private-key
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.9
+    hooks:
+      - id: actionlint
   - repo: https://github.com/compilerla/conventional-pre-commit
     rev: v3.0.0
     hooks:

renovate.json

@@ -17,6 +17,18 @@
       ],
       "depNameTemplate": "infection/infection",
       "datasourceTemplate": "github-releases"
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^\\.github/workflows/actionlint\\.yml$/",
+        "/^\\.claude/hooks/SessionStart\\.sh$/"
+      ],
+      "matchStrings": [
+        "rhysd/actionlint/(?<currentValue>v[0-9.]+)/scripts/download-actionlint\\.bash"
+      ],
+      "depNameTemplate": "rhysd/actionlint",
+      "datasourceTemplate": "github-releases"
     }
   ],
   "packageRules": [