From cd88b349b828fc77355f7643595ab0fed2b17597 Mon Sep 17 00:00:00 2001
From: Robin Bowes <robin@yo61.com>
Date: Thu, 15 Oct 2026 23:26:04 +0100
Subject: [PATCH] ci: lint workflows with jactionlint

Add a .pre-commit-config.yaml holding the jdx/jactionlint hook (v2.2.0),
.github/jactionlint.yaml on the correctness profile, a lint job in CI
running j178/prek-action, and a Dependabot pre-commit ecosystem so the
hook's rev has an updater.

The default profile reports 12 findings (5 missing-timeout,
3 concurrency-limits, 3 dependabot-cooldown, 1 duplicate-triggers);
they are fixed in a follow-up that turns that profile on.

Refs GLB-32

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml   | 14 ++++++++++++++
 .github/jactionlint.yaml |  2 ++
 .github/workflows/ci.yml | 13 +++++++++++++
 .pre-commit-config.yaml  |  5 +++++
 4 files changed, 34 insertions(+)
 create mode 100644 .github/jactionlint.yaml
 create mode 100644 .pre-commit-config.yaml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6984419d..8ebac705 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -22,3 +22,17 @@ updates:
     directory: /
     schedule:
       interval: weekly
+
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      hooks:
+        patterns:
+        - "*"
+        update-types:
+        - "patch"
+        - "minor"
diff --git a/.github/jactionlint.yaml b/.github/jactionlint.yaml
new file mode 100644
index 00000000..cf9a50ef
--- /dev/null
+++ b/.github/jactionlint.yaml
@@ -0,0 +1,2 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/jdx/jactionlint/main/schema/jactionlint-config.json
+profile: correctness
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6b56a351..23ae0315 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,19 @@ on: [push]
 permissions: {}
 
 jobs:
+  lint:
+    permissions:
+      contents: read
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204 # v3.0.1
+        with:
+          prek-version: 0.5.5
+
   sanity-checks:
     permissions:
       contents: read
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 00000000..b7184044
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,5 @@
+repos:
+  - repo: https://github.com/jdx/jactionlint
+    rev: 1027f0a131ab98bc7e191d995bfa15dbed5bbf8f  # frozen: v2.2.0
+    hooks:
+      - id: jactionlint