From 32cd889a61f7588f0fa9a2ab2daaae58018b8ac7 Mon Sep 17 00:00:00 2001 From: Matt Godbolt Date: Fri, 10 Jul 2026 15:59:36 -0500 Subject: [PATCH] Add actionlint to pre-commit Statically checks all workflow files: schema, expression contexts (e.g. a job output or input referenced in an if: must actually exist), reusable-workflow call inputs, and shellcheck over run: scripts. .github/actionlint.yaml declares our self-hosted runner labels. The only finding across the ~95 workflows was SC2086 on ce_install's argument list, where word-splitting is deliberate; annotated as such. Co-Authored-By: Claude Fable 5 --- .github/actionlint.yaml | 6 ++++++ .github/workflows/install-compilers.yml | 1 + .pre-commit-config.yaml | 4 ++++ 3 files changed, 11 insertions(+) create mode 100644 .github/actionlint.yaml diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml new file mode 100644 index 00000000..1cf05e93 --- /dev/null +++ b/.github/actionlint.yaml @@ -0,0 +1,6 @@ +self-hosted-runner: + # Labels of our self-hosted CE runners (see the ce-ci repository) + labels: + - ce + - small + - medium diff --git a/.github/workflows/install-compilers.yml b/.github/workflows/install-compilers.yml index 09775e42..836c59ff 100644 --- a/.github/workflows/install-compilers.yml +++ b/.github/workflows/install-compilers.yml @@ -66,4 +66,5 @@ jobs: if [[ "$FORCE" == "true" ]]; then FORCE_FLAG="--force" fi + # shellcheck disable=SC2086 # word-splitting the flag and filter word lists is the point sudo bin/ce_install --check-user nobody $ENABLE_FLAG install $FORCE_FLAG $COMPILERS diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index a6646245..79666caa 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -10,6 +10,10 @@ repos: rev: 2.1.5 hooks: - id: shellcheck + - repo: https://github.com/rhysd/actionlint + rev: v1.7.12 + hooks: + - id: actionlint - repo: local hooks: - id: builds-up-to-date