Skip to content

ci: lint workflows with jactionlint - #6

Merged
robinbowes merged 1 commit into
mainfrom
ci/jactionlint
Oct 15, 2026
Merged

robinbowes merged 1 commit into
mainfrom
ci/jactionlint

Conversation

@robinbowes

Copy link
Copy Markdown

Adds jactionlint to this repository, which had no workflow linter and no hook framework.

  • .pre-commit-config.yaml: the jdx/jactionlint remote hook at v2.2.0 (SHA-pinned, # frozen:).
  • .github/jactionlint.yaml: profile: correctness.
  • .github/workflows/ci.yml: a lint job running j178/prek-action v3.0.1 (SHA-pinned) with prek 0.5.5, contents: read, persist-credentials: false.
  • .github/dependabot.yml: a pre-commit ecosystem, weekly, 7-day cooldown, minor and patch grouped, so the hook's rev has an updater.

The default profile reports 12 findings (5 missing-timeout, 3 concurrency-limits, 3 dependabot-cooldown, 1 duplicate-triggers). A follow-up fixes them and turns that profile on. runs-on: ubuntu-latest is unchanged here.

Verified locally: prek run --all-files passes; replacing a runs-on: with ${{ matrix.nope }} makes the hook fail.

Linear: GLB-32

🤖 Generated with Claude Code

Add a .pre-commit-config.yaml holding the jdx/jactionlint hook (v2.2.0),
.github/jactionlint.yaml on the correctness profile, a lint job in CI
running j178/prek-action, and a Dependabot pre-commit ecosystem so the
hook's rev has an updater.

The default profile reports 12 findings (5 missing-timeout,
3 concurrency-limits, 3 dependabot-cooldown, 1 duplicate-triggers);
they are fixed in a follow-up that turns that profile on.

Refs GLB-32

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@robinbowes
robinbowes merged commit eefff27 into main Oct 15, 2026
7 checks passed
@robinbowes
robinbowes deleted the ci/jactionlint branch October 15, 2026 22:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant