name: Lint workflows
on:
push:
branches: [ "main" ]
paths: [ ".github/workflows/**", ".github/actions/**", "scripts/**" ]
pull_request:
branches: [ "main" ]
paths: [ ".github/workflows/**", ".github/actions/**", "scripts/**" ]
workflow_dispatch:
workflow_call:
inputs:
caller-run-id:
description: >
Run ID of the calling workflow. `github.event_name` cannot be used to
detect a called run: inside a called workflow the github context is the
caller's, so it is never 'workflow_call'.
required: false
type: string
default: ""
ref:
description: >
Exact commit to check out. Empty (the normal push/PR case) uses the
triggering ref; a release caller pins its resolved release commit.
required: false
type: string
default: ""
permissions:
contents: read
concurrency:
group: actionlint-${{ inputs.caller-run-id || github.ref }}
cancel-in-progress: ${{ !inputs.caller-run-id }}
jobs:
actionlint:
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with:
ref: ${{ inputs.ref }}
persist-credentials: false
- name: Check and test repository shell helpers
run: |
shellcheck -x scripts/*.sh scripts/release/*.sh
scripts/release/test-version.sh
scripts/release/test-homebrew-formula.sh
scripts/release/test-artifacts.sh
- name: Run actionlint
uses: docker://rhysd/actionlint@sha256:9d36088643581e728c969f35141f88139fec77280b2be23c1f66f8e40e1025e7 with:
args: -color