Repository navigation
Lint the workflows with the kjanat actionlint fork (issue #1698) - #1722
Merged
Merged
Conversation
The maintainer decided on 2026-10-14 that every tree lints its workflows with the kjanat/actionlint fork, as btclib does. The fork parses the `uses: $/...` that zizmor's self-repository audit recommends, and rhysd/actionlint does not. The cost is a Go build in pre-commit. Section 4 names the fork's `actionlint-shellcheck` hook, why, and what it costs. This tree's `.pre-commit-config.yaml` takes it from btclib's pinned commit and lists it in `ci: skip`, as btclib does, the build running past pre-commit.ci's time limit. The fork reports `cache-call-unrestricted` on the `claude-review` job. `.github/actionlint.yaml` silences it for that one file until ISS 1717 adds `cache-mode: none` to the job, which must be its own pull request. `test_the_gate_lints_workflows_with_the_actionlint_fork` reads section 4's rule off every tree. No tree but btclib and this one takes the fork yet, so `BACKLOG` excuses the others under ISS 1698; each port deletes its name from the row. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>
#1698) The pin is the sha of the fork's annotated tag, not a commit, so the README, the test and its messages say so. The first commit's body calls it a commit; the squash corrects that. links.yml said the actionlint hook rejects the `$/` form. The fork parses it; the reason that stands is zizmor's finding, declined on the line (ISS 1144). The `ci:` template in section 4 lists `actionlint-shellcheck` in `skip`, and its paragraph gives the reason, so the bullet no longer repeats it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>
`PIN` matches any forty hex characters, so it cannot tell a tag's object from a commit, and yaml drops the `# frozen:` comment. Section 4 says the `rev` is a sha; the tag-object detail stays in the config's comment. `PIN`'s docstring says what `autoupdate` writes in each case. The module's docstring counts the three hooks whose pins are read. The `ci:` paragraph in section 4 no longer has an ambiguous pronoun. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>
…ssue #1698) pre-commit.ci builds the hook's Go environment, then the run fails with `timeout after 180 seconds` (btclib-org/btclib PR 2634). Section 4 says the run outlasts the limit, not the build. In the `ci:` block of the config, the reason for the skip now stands beside uv-lock's, before what the skip costs, as in btclib. The first commit's body repeats the build claim; the squash corrects it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>
…1698) Section 4 gave the reason mypy is skipped twice, in the `ci:` paragraph and in the mypy bullet. The bullet now points at the skip and the paragraph keeps the reason. The zizmor comment no longer calls btclib-org/btclib#1563 the migration: it has been closed since 2026-10-12. `PIN` serves `check-changelog` and the actionlint hook, and the test's docstring says the pin is a sha, which is all `PIN` checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>
Each sentence in the tree that claims what actionlint accepts, types, parses or allows was run against the fork binary. Four were false or partial and are corrected: - reusable-os-suite.yml listed the calling-job keys as the whole list; the fork also allows `cache-mode`, `strategy` and `concurrency`. - reusable-changes.yml said the undeclared-output read is refused only where the caller calls by path; the fork refuses it for `$/` too. - workflows_test.py called `./` the one shape actionlint types. - the `ci:` paragraph and the zizmor comment repeated what the lint workflow paragraph and the actionlint comment already say. `tests/hooks_test.py` names the pins it reads instead of counting them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>
`actionlint_departures` reported only a missing fork hook, so a gate that added the fork and kept the `actionlint-py` stanza passed. It now reports that stanza too, and a test feeds it the two-hook gate. With the clause removed, that test fails. Section 4 states the `ci:` skip once, naming the two hooks. The reason `uses: ./` stays is now cited: workflows_test.py reads `$/` as an unpinned action (ISS 1720). The config says rhysd/actionlint#732 is unmerged. `callee`'s docstring drops an aside. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>
The previous commit left a doc line of 84 columns, which ruff refuses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>
…sue #1698) `actionlint_departures` now reports every hook whose repository names actionlint and is not the fork, upstream's included, and a test feeds it the upstream hook beside the fork. With the clause narrowed back to the Python packaging, that test fails. `ACTIONLINT_REFUSED` no longer says the stanza was carried in the past: gates carry it today. The test's docstring points at section 4 for the reason, and section 4 says upstream does not parse `$/`. The `ci:` paragraph is rewrapped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>
…1698) The control test's docstring said the check reads "the packaging it replaced", which is history. The module docstring repeated what `PIN`'s docstring says about the pins held to a sha. The findings no longer say "still", and the id's docstring no longer restates the hook's role. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>
The docstrings of `actionlint_departures` and its control test said it catches every departure. They now list what it reports: a gate without the fork, a fork hook off its id or pin, and an actionlint hook taken from any other repository. The control test drops "old" from its name and its variable, and the stanza literal no longer says "still". The config's comment on the fork no longer repeats zizmor's `$/` recommendation, which the zizmor comment gives. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>
… ids (issue #1698) btclib-node takes the fork now (kjanat/actionlint, `actionlint-shellcheck`), so its cell passes and a strict expected failure would turn it red. The other names in the row were read from each tree's live config and still take the Python packaging. The control test gives the upstream hook a different id, as rhysd/actionlint offers (`actionlint-system`), and adds a hook from a third repository, so that a check narrowed by id or by repository name fails it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The maintainer decided on 2026-10-14 that every tree moves to the
kjanat/actionlintfork.What it does
actionlint-shellcheckhook, why (it parsesuses: $/...), and its cost (a Go build). README grows by12 10..pre-commit-config.yamltakes the hook at the v1.17.0 tag object2da2ceb4, as btclib does. It lists the hook inci: skip, because its run outlasts pre-commit.ci's time limit..github/actionlint.yamlignores the fork'scache-call-unrestrictedfinding onclaude-review.yml. The real fix is claude-review.yml caps the review call withcache-mode: none, and .github/actionlint.yaml goes #1717.reusable-os-suite.yml,reusable-changes.yml,links.ymlandworkflows_test.py.tests/hooks_test.pychecks section 4's rule on every tree.BACKLOGexcuses the 11 trees not yet ported, so Section 4 names actionlint's Python packaging, and btclib-org/btclib#1563 moves to the kjanat/actionlint fork #1698 stays open.Evidence
The head is
1361ad4, twelve commits on818d84d, signed and signed off. It was rebased once, after #1721, to keep both BACKLOG rows.Reviews. Ten fresh reviewers asked for changes, and every finding was fixed. An eleventh cleared
1361ad4on its first read. It checked:git ls-remoteand pre-commit'sautoupdate.py;Mutations. Reverting the hook fails the new test. Narrowing the non-fork clause fails a test as well, for each of six narrowings.
Gates on the head, under the gate lock at memory pressure 1:
pre-commit run --all-files,actionlint-shellcheckincluded: exit 0.BTCLIB_INTEGRATION=1overhooks_test,backlog_testandworkflows_test: exit 1, with 4 failures. They are the workflows_test.py readsuses: ./as the only local call, and btclib spells it$/#1720 cells for btclib and btclib-node, red onmaintoo. The 11 xfails are the BACKLOG row.🤖 Generated with Claude Code