Actionlint workflow (jeremylongshore/claude-code-plugins-plus-skills)

name: Actionlint
 
# Lints every .github/workflows/*.yml file for syntactically correct GitHub
# Actions YAML, valid event triggers, valid if: expressions, and valid action
# references. New gate per PR 2 of the new-track CI overhaul - the workflow
# split adds 6+ new YAML files, and the validators themselves need a gate.
#
# Fires only when workflow YAML changes.
 
on:
  workflow_dispatch:
  pull_request:
    paths:
      - '.github/workflows/**'
      - '.github/actionlint.yaml'
      - '.github/actionlint-matcher.json'
  push:
    branches: [main]
    paths:
      - '.github/workflows/**'
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  actionlint:
    timeout-minutes: 30
    runs-on: latchkey-small
    steps:
      - uses: actions/checkout@v6
 
      # actionlint releases a single-binary executable; the install script is
      # fetched FROM THE v1.7.4 TAG (not main HEAD) so the script's content is
      # immutable for this version - supply-chain hardening. Bump the tag in
      # BOTH places (URL ref + bash arg) explicitly when updating.
      - name: Install actionlint
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/actionlint"
          curl -sSL \
            https://raw.githubusercontent.com/rhysd/actionlint/v1.7.4/scripts/download-actionlint.bash \
            | bash -s -- 1.7.4 "$RUNNER_TEMP/actionlint"
          "$RUNNER_TEMP/actionlint/actionlint" -version
 
      # BLOCKING - no `|| true`. If a workflow YAML doesn't lint cleanly,
      # the PR cannot merge. This gate protects the workflow split from
      # accidental syntax breakage as PR 3 (prescreen rewrite) lands and
      # subsequent PRs touch the workflow files.
      - name: Run actionlint
        run: |
          "$RUNNER_TEMP/actionlint/actionlint" -color