From 71fc95a7d09521350ffb344b016c8744ed33f78b Mon Sep 17 00:00:00 2001
From: smoochy <34371932+smoochy@users.noreply.github.com>
Date: Mon, 24 Aug 2026 00:00:40 +0200
Subject: [PATCH 1/2] ci: lint workflows with actionlint

Workflow changes had no automated check: a YAML parse proved the file
loads, but nothing caught unknown context properties, invalid
expressions, undefined step outputs or shell problems inside run blocks.

Adds a job running the upstream actionlint container over the repository
on every push and pull request that touches .github/workflows. The
workflow lints itself, so its own pull-request run is the proof.

Closes #22

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/lint_workflows.yaml | 32 +++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 .github/workflows/lint_workflows.yaml

diff --git a/.github/workflows/lint_workflows.yaml b/.github/workflows/lint_workflows.yaml
new file mode 100644
index 0000000..99a88c1
--- /dev/null
+++ b/.github/workflows/lint_workflows.yaml
@@ -0,0 +1,32 @@
+name: Lint workflows
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - .github/workflows/**
+
+  pull_request:
+    paths:
+      - .github/workflows/**
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: lint-workflows-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Run actionlint
+        uses: docker://rhysd/actionlint:1.7.12
+        with:
+          args: -color

From 86e958418b9b8653bb5e99ebc7b92434c737ad81 Mon Sep 17 00:00:00 2001
From: smoochy <34371932+smoochy@users.noreply.github.com>
Date: Mon, 24 Aug 2026 00:04:03 +0200
Subject: [PATCH 2/2] ci: exclude three noisy shellcheck rules from actionlint

The first run reported 19 findings, all from shellcheck and none from
actionlint itself. SC2016 fires on the single-quoted jq programs, which
must stay literal. SC2129 is pure style. SC2155 warns about a masked
return value in blocks that run without set -e and already fall back
with || echo "". Everything else stays enabled.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/lint_workflows.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/lint_workflows.yaml b/.github/workflows/lint_workflows.yaml
index 99a88c1..3334814 100644
--- a/.github/workflows/lint_workflows.yaml
+++ b/.github/workflows/lint_workflows.yaml
@@ -28,5 +28,12 @@ jobs:
 
       - name: Run actionlint
         uses: docker://rhysd/actionlint:1.7.12
+        env:
+          # actionlint runs shellcheck over every run: block. Three of its checks are noise here:
+          # SC2016 fires on the single-quoted jq programs, which must stay literal; SC2129 is pure
+          # style; SC2155 warns about a masked return value in blocks that run without set -e and
+          # already fall back with || echo "". Every other shellcheck rule and all actionlint
+          # checks stay enabled.
+          SHELLCHECK_OPTS: --exclude=SC2016,SC2129,SC2155
         with:
           args: -color