[woksin]

Workflow changes in this repository are now linted and smoke-run on the pull request, before they reach main and every consumer.

Added

• Reusable workflow-lint.yml: runs a pinned, checksum-verified actionlint over all of a caller's workflows (optionally shellcheck and extra files), using the caller's .github/actionlint.yaml when present or a shared configuration that knows the Cratis runner labels. (part of Give workflow-file changes a non-target PR smoke job #192)
• smoke-workflows.yml: on pull requests that change workflows, actions or templates, calls the read-only reusable workflows from the pull request's own commit, so a broken reusable fails its PR instead of every consumer after merge. Workflows that need secrets or write access are listed as not smokeable, with a manual fallback documented in the README. (part of Give workflow-file changes a non-target PR smoke job #192)

Changed

• The publish template's placeholder publish jobs now fail with an explicit error until replaced, so a copied template can never succeed silently without publishing. (part of Give workflow-file changes a non-target PR smoke job #192)

[woksin]

Reviewer notes (not release notes)

• Tracks Give workflow-file changes a non-target PR smoke job #192 (phase 1: Workflows repo only; consumer rollout Arc → Stage → Chronicle → Studio follows in separate PRs).
• Local: actionlint, actionlint .github/templates/publish.template.yml, workflow-lint.test.py, verify-public-runners.test.py, workflow-templates.test.py, bootstrap-policy.test.py, verify-release-notes.spec.mjs, bash -n install-actionlint.sh all exit 0.
• Full cross-provider review (Opus + Sol) at f52361b: passed, no findings; installer checksums verified against upstream actionlint 1.7.12.
• Not verified locally: GitHub-hosted execution. This PR's own Smoke Workflows run is the first hosted run; I will also open a throwaway PR with a deliberately broken workflow to prove lint fails, then close it.
• Decisions: release-policy reusables are NOT_SMOKEABLE (decide separately), the smoke check is not a required check, no PR template edit, ubuntu-latest.