actionlint.yml

# The CI of the CI. Every workflow YAML in this directory is itself
# code — a malformed `if` expression, a typo in `needs:`, or a matrix
# value that does not exist will pass `yaml.safe_load` but blow up at
# runtime, sometimes hours after merge. actionlint catches that class
# of mistake locally-equivalent on every PR that touches workflows.
#
# Version pinned (no `main`, no `@latest`): actionlint occasionally
# tightens rules between releases, so a silent upgrade could turn a
# green PR red overnight. Bump in a dedicated PR.
name: actionlint

on:
  workflow_call:
    inputs:
      ref:
        type: string
        required: true

permissions:
  contents: read

jobs:
  actionlint:
    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-24.04' || 'blacksmith-2vcpu-ubuntu-2404' }}
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref }}
      - name: Download actionlint
        run: bash <(curl -sSf https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.7.12
      - name: Run actionlint
        run: ./actionlint -color