From a4ce6a1c16f5a2666628e912c383050a6eb38cea Mon Sep 17 00:00:00 2001 From: Tim Diekmann Date: Mon, 10 Aug 2026 23:17:01 +0200 Subject: [PATCH 1/4] SRE-927: Fix shellcheck findings surfaced by actionlint --- .github/workflows/lint.yml | 2 +- .github/workflows/preflight-todo-comments.yml | 30 +++++++++++-------- 2 files changed, 19 insertions(+), 13 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 35641d3..87a53ba 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -43,7 +43,7 @@ jobs: echo '' echo 'ℹ️ ℹ️ ℹ️' echo 'Please fix the above errors locally for the check to pass.' - echo 'If you don’t see them, try merging target branch into yours.' + echo 'If you do not see them, try merging target branch into yours.' echo 'ℹ️ ℹ️ ℹ️' exit 1 fi diff --git a/.github/workflows/preflight-todo-comments.yml b/.github/workflows/preflight-todo-comments.yml index fac2e3e..8288f75 100644 --- a/.github/workflows/preflight-todo-comments.yml +++ b/.github/workflows/preflight-todo-comments.yml @@ -45,12 +45,16 @@ jobs: if [[ -z "$TICKETS" ]]; then echo "No ticket IDs found in PR title" - echo "tickets=" >> "$GITHUB_OUTPUT" - echo "has_tickets=false" >> "$GITHUB_OUTPUT" + { + echo "tickets=" + echo "has_tickets=false" + } >> "$GITHUB_OUTPUT" else echo "Found ticket IDs: $TICKETS" - echo "tickets=$TICKETS" >> "$GITHUB_OUTPUT" - echo "has_tickets=true" >> "$GITHUB_OUTPUT" + { + echo "tickets=$TICKETS" + echo "has_tickets=true" + } >> "$GITHUB_OUTPUT" fi - name: Search for TODO comments with ticket IDs @@ -105,14 +109,16 @@ jobs: echo "::error::TODOs associated with tickets in this PR were found in the codebase." echo "::error::Please resolve these TODOs before merging, as the associated ticket(s) will be marked as done." echo "" - echo "## Found TODO comments" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "The following TODO comments reference ticket IDs from this PR's title." >> "$GITHUB_STEP_SUMMARY" - echo "Please resolve these TODOs before merging, as the associated ticket(s) will be marked as done." >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo '```' >> "$GITHUB_STEP_SUMMARY" - echo "$FOUND_TODOS" >> "$GITHUB_STEP_SUMMARY" - echo '```' >> "$GITHUB_STEP_SUMMARY" + { + echo "## Found TODO comments" + echo "" + echo "The following TODO comments reference ticket IDs from this PR's title." + echo "Please resolve these TODOs before merging, as the associated ticket(s) will be marked as done." + echo "" + echo '```' + echo "$FOUND_TODOS" + echo '```' + } >> "$GITHUB_STEP_SUMMARY" exit 1 fi From ded48cc3d6d451d79091888e28fca8dea537ebf2 Mon Sep 17 00:00:00 2001 From: Tim Diekmann Date: Mon, 10 Aug 2026 23:17:12 +0200 Subject: [PATCH 2/4] SRE-927: Add a reusable actionlint preflight workflow --- .github/workflows/preflight-actionlint.yml | 31 ++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 .github/workflows/preflight-actionlint.yml diff --git a/.github/workflows/preflight-actionlint.yml b/.github/workflows/preflight-actionlint.yml new file mode 100644 index 0000000..2a65506 --- /dev/null +++ b/.github/workflows/preflight-actionlint.yml @@ -0,0 +1,31 @@ +# Lint GitHub Actions workflows +# +# Reusable workflow that runs actionlint over the calling repository's +# workflow files, with the actionlint version pinned centrally. +name: Actionlint + +on: + pull_request: + merge_group: + workflow_call: + +permissions: + contents: read + +jobs: + lint: + name: Actions + runs-on: ubuntu-24.04 + # The default checkout resolves to the PR merge commit or the merge-group + # ref; any other calling event would silently lint the base branch. + if: github.event_name == 'pull_request' || github.event_name == 'merge_group' + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + # TODO(SRE-941): drop the -ignore flags once actionlint knows `$/` (rhysd/actionlint#711) + - name: Actionlint + run: >- + go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 + -ignore 'specifying action "\$/.+" in invalid format because ref is missing' + -ignore 'reusable workflow call "\$/.+" at "uses" is not following the format' From 498475ea403ebdcc0fd5136a9a46dfab4e792461 Mon Sep 17 00:00:00 2001 From: Tim Diekmann Date: Mon, 10 Aug 2026 23:21:34 +0200 Subject: [PATCH 3/4] SRE-927: Track go-run pins in workflows with Renovate --- renovate-config.json | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/renovate-config.json b/renovate-config.json index 0e16b08..387f69a 100644 --- a/renovate-config.json +++ b/renovate-config.json @@ -440,6 +440,14 @@ "packageNameTemplate": "rust-lang/rust-analyzer", "datasourceTemplate": "github-releases", "versioningTemplate": "regex:(?\\d+)-(?\\d+)-(?\\d+)" + }, + { + "customType": "regex", + "fileMatch": ["(^|/)\\.github/workflows/[^/]+\\.ya?ml$"], + "matchStrings": [ + "go run (?[^\\s@]+)/cmd/[^\\s@]+@(?v\\d+\\.\\d+\\.\\d+)" + ], + "datasourceTemplate": "go" } ] } From 9584e1de3d41867d95987ea3834aa204a345b9ce Mon Sep 17 00:00:00 2001 From: Tim Diekmann Date: Mon, 10 Aug 2026 23:23:28 +0200 Subject: [PATCH 4/4] SRE-927: Name the actionlint preflight workflow Lint --- .github/workflows/preflight-actionlint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/preflight-actionlint.yml b/.github/workflows/preflight-actionlint.yml index 2a65506..5147cad 100644 --- a/.github/workflows/preflight-actionlint.yml +++ b/.github/workflows/preflight-actionlint.yml @@ -2,7 +2,7 @@ # # Reusable workflow that runs actionlint over the calling repository's # workflow files, with the actionlint version pinned centrally. -name: Actionlint +name: Lint on: pull_request: