diff --git a/.github/workflows/ci-actionlint.yml b/.github/workflows/ci-actionlint.yml
new file mode 100644
index 000000000..417708add
--- /dev/null
+++ b/.github/workflows/ci-actionlint.yml
@@ -0,0 +1,26 @@
+#file: noinspection UndefinedAction,UndefinedParamsPresent
+name: "CI: actionlint"
+
+on:
+    pull_request:
+    push:
+        branches:
+            - core
+
+permissions:
+    contents: read
+
+jobs:
+    actionlint:
+        name: "CI: actionlint"
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v7
+
+            - name: Run actionlint
+              uses: raven-actions/actionlint@v2
+              with:
+                  version: 1.7.12
+                  files: ".github/workflows/*.yml"
+                  fail-on-error: true
diff --git a/.github/workflows/shared-release-publish.yml b/.github/workflows/shared-release-publish.yml
index 86f39c298..91cbc5e3f 100644
--- a/.github/workflows/shared-release-publish.yml
+++ b/.github/workflows/shared-release-publish.yml
@@ -120,7 +120,13 @@ jobs:
 
             -   name: Verify Package Natives
                 run: |
-                    PACKAGE=$(ls ./release/InfiniLore.InfiniFrame.NativeBridge.*.nupkg 2>/dev/null | grep -v '\.symbols\.nupkg$' | head -n 1 || true)
+                    PACKAGE=""
+                    for candidate in ./release/InfiniLore.InfiniFrame.NativeBridge.*.nupkg; do
+                        if [[ -f "$candidate" && "$candidate" != *.symbols.nupkg ]]; then
+                            PACKAGE="$candidate"
+                            break
+                        fi
+                    done
 
                     if [ -z "$PACKAGE" ]; then
                         echo "❌ No NativeBridge package found in ./release !"
diff --git a/.github/workflows/shared-testing-dotnetpack.yml b/.github/workflows/shared-testing-dotnetpack.yml
index 2d8bfea49..0325bc368 100644
--- a/.github/workflows/shared-testing-dotnetpack.yml
+++ b/.github/workflows/shared-testing-dotnetpack.yml
@@ -84,7 +84,13 @@ jobs:
 
             -   name: Verify NativeBridge Package Natives
                 run: |
-                    PACKAGE=$(ls ./release/InfiniLore.InfiniFrame.NativeBridge.*.nupkg 2>/dev/null | grep -v '\.symbols\.nupkg$' | head -n 1 || true)
+                    PACKAGE=""
+                    for candidate in ./release/InfiniLore.InfiniFrame.NativeBridge.*.nupkg; do
+                      if [[ -f "$candidate" && "$candidate" != *.symbols.nupkg ]]; then
+                        PACKAGE="$candidate"
+                        break
+                      fi
+                    done
 
                     if [ -z "$PACKAGE" ]; then
                         echo "❌ No InfiniFrame.NativeBridge package found in ./release"
@@ -125,7 +131,13 @@ jobs:
                 run: |
                     set -euo pipefail
 
-                    PACKAGE=$(ls ./release/InfiniLore.InfiniFrame.NativeBridge.*.nupkg 2>/dev/null | grep -v '\.symbols\.nupkg$' | head -n 1 || true)
+                    PACKAGE=""
+                    for candidate in ./release/InfiniLore.InfiniFrame.NativeBridge.*.nupkg; do
+                      if [[ -f "$candidate" && "$candidate" != *.symbols.nupkg ]]; then
+                        PACKAGE="$candidate"
+                        break
+                      fi
+                    done
 
                     if [ -z "$PACKAGE" ]; then
                         echo "❌ No InfiniFrame.NativeBridge package found in ./release"
diff --git a/.github/workflows/shared-testing-linux.yml b/.github/workflows/shared-testing-linux.yml
index 1010bb752..c3f07a05c 100644
--- a/.github/workflows/shared-testing-linux.yml
+++ b/.github/workflows/shared-testing-linux.yml
@@ -163,7 +163,7 @@ jobs:
                         &> compositor.log &
 
                       echo "Waiting for Wayland compositor..."
-                      timeout 30 bash -c 'until [ -S "$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY" ]; do sleep 1; done' || {
+                      timeout 30 bash -c "until [ -S \"$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY\" ]; do sleep 1; done" || {
                         echo "Wayland compositor failed to start."
                         cat compositor.log || true
                         exit 1
@@ -213,12 +213,14 @@ jobs:
                       }
 
                       echo "Openbox is running:"
-                      ps aux | grep "[o]penbox" || echo "Openbox missing unexpectedly"
+                      pgrep -a -x openbox || echo "Openbox missing unexpectedly"
 
-                      timeout 5 xwininfo -root >/dev/null 2>&1 && echo "Window manager responding" || {
+                      if timeout 5 xwininfo -root >/dev/null 2>&1; then
+                        echo "Window manager responding"
+                      else
                         echo "Window manager not responding"
                         exit 1
-                      }
+                      fi
 
                       echo "=== Environment Status ==="
                       echo "Display: $DISPLAY"
diff --git a/.github/workflows/shared-testing.yml b/.github/workflows/shared-testing.yml
index b88903408..b404abc68 100644
--- a/.github/workflows/shared-testing.yml
+++ b/.github/workflows/shared-testing.yml
@@ -69,7 +69,7 @@ jobs:
                       SHA=$(curl -s \
                         -H "Authorization: Bearer $GITHUB_TOKEN" \
                         -H "Accept: application/vnd.github+json" \
-                        https://api.github.com/repos/${{ github.repository }}/pulls/${{ inputs.pr_number }} \
+                        "https://api.github.com/repos/${{ github.repository }}/pulls/${{ inputs.pr_number }}" \
                         | jq -r .head.sha)
                     else
                       SHA="${{ github.sha }}"
@@ -80,7 +80,7 @@ jobs:
                       exit 1
                     fi
 
-                    echo "sha=$SHA" >> $GITHUB_OUTPUT
+                    echo "sha=$SHA" >> "$GITHUB_OUTPUT"
 
     docs-validation:
         name: "CI: docs"