From d6e0ce0e84c8d25ff7ac390ecd2d82b413334fde Mon Sep 17 00:00:00 2001
From: Robin Bowes <robin@yo61.com>
Date: Sat, 17 Oct 2026 13:14:28 +0100
Subject: [PATCH] ci: turn on jactionlint's online rules

Set JACTIONLINT_ONLINE and GITHUB_TOKEN on the lint job's prek step, so
jactionlint runs its online rules in CI. The job has contents: read only
and writes nothing.

Refs GLB-83.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 229ee007..a9755f60 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,6 +22,9 @@ jobs:
         env:
           # renovate: datasource=github-releases depName=j178/prek extractVersion=^v(?<version>.+)$
           PREK_VERSION: 0.5.5
+          # jactionlint's online rules (yo61/global decisions/2026-10-17-retire-zizmor.md).
+          JACTIONLINT_ONLINE: 1
+          GITHUB_TOKEN: ${{ github.token }}
         with:
           prek-version: ${{ env.PREK_VERSION }}