feat(actions-runner): bake actionlint into the mise toolchain - #6
Merged
Conversation
home-ops' new "checks" workflow lints every workflow file with actionlint on every PR; fetching+checksum-verifying the binary fresh each run is exactly the per-repo drift this image exists to absorb. Add it to mise.toml alongside hadolint/shellcheck (same static-binary, workflow tooling category) and bump the revision so IfNotPresent-pulling scale sets pick up the new tag. Signed-off-by: swibrow <15628653+swibrow@users.noreply.github.com>
3 tasks
swibrow
added a commit
that referenced
this pull request
Aug 7, 2026
Same rationale as actionlint (#6): home-ops' checks.yaml runs pre-commit's terraform_tflint hook on every PR, which shells out to a bare `tflint` on PATH — this image didn't ship one. Static, version-insensitive binary, same category as hadolint/shellcheck. Signed-off-by: swibrow <15628653+swibrow@users.noreply.github.com>
swibrow
added a commit
to swibrow/home-ops
that referenced
this pull request
Aug 7, 2026
Move checks.yaml off ubuntu-latest onto the home-ops ARC scale set, pinned to ghcr.io/cloudsnacks/actions-runner:2.336.0-5 (cloudsnacks/containers#6, #7), which bakes actionlint and tflint into its mise toolchain instead of fetching+checksumming them on every PR. Only the runner container's image is overridden — initContainers/volumes stay inherited from the shared values.yaml so the dind setup is untouched. python (for pre-commit) and terraform (for terraform_fmt) still come from setup-* actions per run — neither is a static, version-insensitive binary, so per the runner image's own convention they don't belong baked in. Also fixes a latent gap from the previous commit: this required check never actually ran on a PR yet, and neither ubuntu-latest nor the custom runner ship terraform/tflint, so terraform_fmt/terraform_tflint would have failed on first run. Signed-off-by: swibrow <15628653+swibrow@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
actionlinttoimages/actions-runner/mise.toml(same static-binary category ashadolint/shellcheck)metadata.yamlversion to2.336.0-4(content changed,RUNNER_VERSIONdid not)Why
home-ops'
checks.yamlworkflow lints every GitHub Actions workflow file with actionlint on every PR. It currently curl+checksum-verifies the binary fresh on each run. Baking it into this runner image removes that per-run fetch, matching howhadolint/shellcheck/yqare already handled here.Test plan
container build -t actions-runner:local -f images/actions-runner/Dockerfile images/actions-runnersucceeds, mise installsactionlint@1.7.12via the aqua backend with attestation verificationmetadata.yaml'stestcommand passes against the built image (generic mise-tool loop picks up actionlint automatically)actionlint --versionresolves through the mise shim inside the image