SRE-927: Add a reusable actionlint preflight workflow

[TimDiekmann]

Purpose

Adds a reusable actionlint preflight workflow so every repo lints its GitHub Actions workflows with a centrally pinned actionlint, following the preflight-* pattern. Prerequisite for rolling out the $/ self-repository syntax (SRE-927): actionlint 1.7.12 rejects $/, so the ignores live here, centrally, until upstream support lands (SRE-941, rhysd/actionlint#711).

Related links

• SRE-927 (internal)
• SRE-941 (internal)

What does this change?

• New preflight-actionlint.yml: workflow_call-able, self-triggers on pull_request/merge_group, runs go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 with the two $/ ignores. Job guard mirrors preflight-todo-comments.yml: any other calling event would silently lint the base branch.
• Shellcheck fixes in lint.yml (unicode apostrophe) and preflight-todo-comments.yml (grouped redirects) — surfaced by actionlint's shellcheck integration; behaviour unchanged. Needed for this repo's own runs of the new check to start green.
• New custom manager in the shared Renovate preset: tracks go run <module>/cmd/<bin>@<version> pins in workflow steps (the new check here and the existing housekeeping validate jobs in every consumer repo), so these pins get updates with the preset's minimumReleaseAge gate applied.

How to test this?

• The new workflow triggers on this PR and lints this repo's workflows (which already use $/)
• Caller check name in consumer repos: <workflow> / <caller job> / Actions

[cursor]

PR Summary

Low Risk
CI and Renovate preset changes only; no runtime application or security logic is modified.

Overview
Adds preflight-actionlint.yml, a reusable workflow_call workflow (and self-trigger on pull_request / merge_group) that runs a centrally pinned actionlint v1.7.12 via go run, with job guards matching other preflights so only PR/merge-group refs are linted. Two -ignore rules are applied until actionlint supports the org’s $/ workflow syntax (SRE-941).

Shellcheck-only tweaks in lint.yml (ASCII apostrophe in a message) and preflight-todo-comments.yml (grouped redirects to GITHUB_OUTPUT / GITHUB_STEP_SUMMARY) so the new linter passes without changing behavior.

Extends the shared renovate-config.json preset with a regex custom manager that bumps go run …/cmd/…@v* pins in .github/workflows/*.yml, so actionlint and similar CLI pins get Renovate updates under the preset’s release-age rules.

^{Reviewed by Cursor Bugbot for commit 9584e1d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Adds a centrally pinned, reusable actionlint “preflight” workflow to lint GitHub Actions workflows across repositories, alongside small shellscript tweaks needed to keep this repo green and a Renovate enhancement to keep the pinned go run ...@vX.Y.Z versions up to date.

Changes:

• Introduce a reusable preflight-actionlint.yml workflow that runs actionlint (pinned to v1.7.12) with temporary ignores for the $/ syntax.
• Apply shellcheck-motivated edits in existing workflows (lint.yml, preflight-todo-comments.yml) without changing behavior.
• Extend the shared Renovate preset with a custom regex manager to update go run <module>/cmd/<bin>@<version> pins in workflow files.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
renovate-config.json	Adds a Renovate custom regex manager to track and update pinned go run ...@vX.Y.Z versions in workflow steps.
.github/workflows/preflight-todo-comments.yml	Groups repeated output/summary redirects to satisfy shellcheck while preserving behavior.
.github/workflows/preflight-actionlint.yml	Adds a reusable actionlint preflight workflow pinned to actionlint@v1.7.12 with temporary $/ ignores.
.github/workflows/lint.yml	Replaces a Unicode apostrophe in an echoed message to satisfy shellcheck.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.