SRE-927: Add a reusable actionlint preflight workflow

.github/workflows/lint.yml

@@ -43,7 +43,7 @@ jobs:
             echo ''
             echo 'ℹ️ ℹ️ ℹ️'
             echo 'Please fix the above errors locally for the check to pass.'
-            echo 'If you don’t see them, try merging target branch into yours.'
+            echo 'If you do not see them, try merging target branch into yours.'
             echo 'ℹ️ ℹ️ ℹ️'
             exit 1
           fi

.github/workflows/preflight-actionlint.yml

@@ -0,0 +1,31 @@
+# Lint GitHub Actions workflows
+#
+# Reusable workflow that runs actionlint over the calling repository's
+# workflow files, with the actionlint version pinned centrally.
+name: Lint
+
+on:
+  pull_request:
+  merge_group:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Actions
+    runs-on: ubuntu-24.04
+    # The default checkout resolves to the PR merge commit or the merge-group
+    # ref; any other calling event would silently lint the base branch.
+    if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # TODO(SRE-941): drop the -ignore flags once actionlint knows `$/` (rhysd/actionlint#711)
+      - name: Actionlint
+        run: >-
+          go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+          -ignore 'specifying action "\$/.+" in invalid format because ref is missing'
+          -ignore 'reusable workflow call "\$/.+" at "uses" is not following the format'

.github/workflows/preflight-todo-comments.yml

@@ -45,12 +45,16 @@ jobs:
 
           if [[ -z "$TICKETS" ]]; then
             echo "No ticket IDs found in PR title"
-            echo "tickets=" >> "$GITHUB_OUTPUT"
-            echo "has_tickets=false" >> "$GITHUB_OUTPUT"
+            {
+              echo "tickets="
+              echo "has_tickets=false"
+            } >> "$GITHUB_OUTPUT"
           else
             echo "Found ticket IDs: $TICKETS"
-            echo "tickets=$TICKETS" >> "$GITHUB_OUTPUT"
-            echo "has_tickets=true" >> "$GITHUB_OUTPUT"
+            {
+              echo "tickets=$TICKETS"
+              echo "has_tickets=true"
+            } >> "$GITHUB_OUTPUT"
           fi
 
       - name: Search for TODO comments with ticket IDs
@@ -105,14 +109,16 @@ jobs:
             echo "::error::TODOs associated with tickets in this PR were found in the codebase."
             echo "::error::Please resolve these TODOs before merging, as the associated ticket(s) will be marked as done."
             echo ""
-            echo "## Found TODO comments" >> "$GITHUB_STEP_SUMMARY"
-            echo "" >> "$GITHUB_STEP_SUMMARY"
-            echo "The following TODO comments reference ticket IDs from this PR's title." >> "$GITHUB_STEP_SUMMARY"
-            echo "Please resolve these TODOs before merging, as the associated ticket(s) will be marked as done." >> "$GITHUB_STEP_SUMMARY"
-            echo "" >> "$GITHUB_STEP_SUMMARY"
-            echo '```' >> "$GITHUB_STEP_SUMMARY"
-            echo "$FOUND_TODOS" >> "$GITHUB_STEP_SUMMARY"
-            echo '```' >> "$GITHUB_STEP_SUMMARY"
+            {
+              echo "## Found TODO comments"
+              echo ""
+              echo "The following TODO comments reference ticket IDs from this PR's title."
+              echo "Please resolve these TODOs before merging, as the associated ticket(s) will be marked as done."
+              echo ""
+              echo '```'
+              echo "$FOUND_TODOS"
+              echo '```'
+            } >> "$GITHUB_STEP_SUMMARY"
             exit 1
           fi
 

renovate-config.json

@@ -440,6 +440,14 @@
       "packageNameTemplate": "rust-lang/rust-analyzer",
       "datasourceTemplate": "github-releases",
       "versioningTemplate": "regex:(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["(^|/)\\.github/workflows/[^/]+\\.ya?ml$"],
+      "matchStrings": [
+        "go run (?<depName>[^\\s@]+)/cmd/[^\\s@]+@(?<currentValue>v\\d+\\.\\d+\\.\\d+)"
+      ],
+      "datasourceTemplate": "go"
     }
   ]
 }