ci: lint workflows with jactionlint

.github/dependabot.yml

@@ -22,3 +22,17 @@ updates:
     directory: /
     schedule:
       interval: weekly
+
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      hooks:
+        patterns:
+        - "*"
+        update-types:
+        - "patch"
+        - "minor"

.github/jactionlint.yaml

@@ -0,0 +1,2 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/jdx/jactionlint/main/schema/jactionlint-config.json
+profile: correctness

.github/workflows/ci.yml

@@ -4,6 +4,19 @@ on: [push]
 permissions: {}
 
 jobs:
+  lint:
+    permissions:
+      contents: read
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204 # v3.0.1
+        with:
+          prek-version: 0.5.5
+
   sanity-checks:
     permissions:
       contents: read

.pre-commit-config.yaml

@@ -0,0 +1,5 @@
+repos:
+  - repo: https://github.com/jdx/jactionlint
+    rev: 1027f0a131ab98bc7e191d995bfa15dbed5bbf8f  # frozen: v2.2.0
+    hooks:
+      - id: jactionlint