Add actionlint to pre-commit - #68
Conversation
Statically checks all workflow files: schema, expression contexts (e.g. a job output or input referenced in an if: must actually exist), reusable-workflow call inputs, and shellcheck over run: scripts. .github/actionlint.yaml declares our self-hosted runner labels. The only finding across the ~95 workflows was SC2086 on ce_install's argument list, where word-splitting is deliberate; annotated as such. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds actionlint to the repository’s pre-commit suite so GitHub Actions workflows are statically validated (workflow schema/expression checks and shellcheck over run: blocks), with repo-specific configuration for self-hosted runner labels.
Changes:
- Add
rhysd/actionlintas a pre-commit hook. - Add
.github/actionlint.yamlto declare custom self-hosted runner labels forruns-onvalidation. - Suppress ShellCheck SC2086 for the intentional word-splitting in
install-compilers.yml.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.pre-commit-config.yaml |
Adds the actionlint hook to the pre-commit pipeline. |
.github/workflows/install-compilers.yml |
Documents intentional word-splitting with a targeted ShellCheck suppression. |
.github/actionlint.yaml |
Configures actionlint with the repo’s self-hosted runner labels so runs-on checks succeed. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - repo: https://github.com/rhysd/actionlint | ||
| rev: v1.7.12 | ||
| hooks: | ||
| - id: actionlint |
There was a problem hiding this comment.
Declining — this is out of date: pre-commit auto-provisions a Go toolchain for language: golang hooks since pre-commit 3.0. Empirically verified while building this PR: the machine it was developed on has no go on PATH at all, and pre-commit run actionlint installed and built the hook fine (the downloaded toolchain lives in the hook's cached env). CI uses the same mechanism via make pre-commit, so nothing depends on runner images shipping Go.
Part of the actionlint rollout across CE repos (compiler-explorer/compiler-workflows#68, compiler-explorer/infra#2226). [actionlint](https://github.com/rhysd/actionlint) statically checks workflow files: schema/typos, expression type-checking against real contexts (undefined inputs/outputs/needs are errors), unknown runner labels, and shellcheck over embedded `run:` scripts. This repo has no pre-commit framework, so it's wired as a small CI workflow that runs on any push/PR touching `.github/workflows/**`, using the pinned official docker image. `.github/actionlint.yaml` declares the self-hosted `admin` label so `runs-on: [admin]` (deploy workflows) checks correctly. The existing ten workflows already pass with no findings. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
First of a set of PRs adding actionlint across the CE repos — this repo first since workflows are the product here, and a generator bug fans out into ~95 files.
It statically checks every workflow: schema/typos, expression type-checking against real contexts (an
if:referencing a job output or dispatch input that doesn't exist is an error, not a silent runtime false), reusable-workflowwith:vs declared inputs, and shellcheck overrun:scripts. It would have machine-verified the trickiest parts of #67.make pre-commit, so it's enforced there too)..github/actionlint.yamldeclares the self-hosted runner labels (ce,small,medium) soruns-onchecking works.ce_installargument list ininstall-compilers.yml, where word-splitting is deliberate — annotated with a disable-and-reason rather than quoted (which would break it).🤖 Generated with Claude Code