fix: add actionlint coverage for scaffold workflow templates

[ralphbean]

Summary

• Add hack/lint-scaffold-workflows to run actionlint on scaffold templates (with __ORG__ placeholder substitution) — the existing pre-commit actionlint hook only covers .github/workflows/ in the repo root
• Wire it into .pre-commit-config.yaml with the same file trigger as lint-workflow-size
• Remove secrets: {} from shim-workflow-call.yaml — actionlint flags empty secrets sections when the called workflow declares none (fixes the lint failure on chore: update fullsend shim workflow #1028)
• Remove corresponding test assertion in scaffold_test.go

Context

secrets: {} was introduced in #503 as an explicit "pass no secrets" when migrating from PAT to OIDC, then carried forward in #792 when per-stage jobs were collapsed into a single dispatch job. The intent was correct but actionlint considers it a syntax error. Omitting secrets: entirely has the same effect.

Test plan

• hack/lint-scaffold-workflows passes after removing secrets: {}
• pre-commit run lint-scaffold-workflows --all-files passes
• CI lint job passes

🤖 Generated with Claude Code

[github-actions]

Site preview

Preview: https://8233f28b-site.fullsend-ai.workers.dev

Commit: e24b939ae823fe59e6bf678fb7609336d7a67cd7

[rh-hemartin]

Please, make use of pre-commit you can specify which files are passed with files:

- repo: https://github.com/rhysd/actionlint
    rev: v1.7.11
    hooks:
      - id: actionlint
        files: |
          (?x)^(
            \.github/workflows/
            |internal/scaffold/fullsend-repo/.github/workflows
            |internal/scaffold/fullsend-repo/templates
          )
        args: ["-ignore", 'unexpected key "queue" for "concurrency"']

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .pre-commit-config.yaml — This PR modifies .pre-commit-config.yaml, which is a protected governance/infrastructure file. The PR has no linked issue. While the PR body explains the rationale (extending actionlint coverage to scaffold templates, fixing lint failure from chore: update fullsend shim workflow #1028), protected-path changes require a linked issue for traceability. Human approval is required for all protected-path changes.
  Remediation: Link the PR to an issue (e.g., use "Fixes chore: update fullsend shim workflow #1028" if that issue covers this work, or create a dedicated issue) to provide formal authorization for modifying governance files.

Low

• [intent-alignment] .pre-commit-config.yaml — The PR description describes adding a hack/lint-scaffold-workflows script and removing secrets: {} from shim-workflow-call.yaml, but neither change is present in the actual diff. The final implementation expanded the existing actionlint hook's files pattern instead. The PR description should be updated to match the actual implementation to avoid confusion for future readers.
  Remediation: Update the PR body to describe the actual approach (expanding actionlint's files filter and adding ignore rules) rather than the original approach (separate hack script and template modification).

Previous run

Review

Findings

Medium

• [protected-path] .pre-commit-config.yaml — This PR modifies .pre-commit-config.yaml, which is a protected governance/infrastructure file. The PR body provides sufficient context (extending actionlint coverage to scaffold templates, fixing lint failure from chore: update fullsend shim workflow #1028), but human approval is always required for protected-path changes regardless of context.

Low

• [correctness] .pre-commit-config.yaml — The PR body describes adding a hack/lint-scaffold-workflows script and references running pre-commit run lint-scaffold-workflows --all-files in the test plan, but the final implementation (per commit "fix: simplify scaffold actionlint to use pre-commit files pattern") took a different approach — expanding the existing actionlint hook's files pattern instead. The PR description should be updated to match the actual implementation to avoid confusion for future readers.
  Remediation: Update the PR body to describe the actual approach (expanding actionlint's files filter) rather than the original approach (separate hack script).

[fullsend-ai-review]

See the review comment for full details.