Lint the workflows every other repository depends on #5

Merged

marcos-mendez merged 1 commit from ci/lint-workflows into main

2026-09-26 18:50:45 -03:00

marcos-mendez commented

2026-09-26 18:49:52 -03:00

(Migrated from github.com)

This repository holds the four reusable workflows the whole organization calls
at @main, and it was the only active repository with no check of its own and
no protection on its default branch. A mistake pushed here breaks every gate
at once, and nothing downstream catches it: a caller only learns that its
check failed to start.

lint.yml runs actionlint, pinned by version and sha256 the way test-shell
pins kcov. It parses each workflow, checks expressions, runner labels
(.github/actionlint.yaml declares keel-lxc) and action inputs, and runs
shellcheck over every run block. Any report fails the job, informational
ones included: four workflows that lint clean is a state worth defending, and
a tolerated info line is how the first real warning gets lost.

Four findings, all real, all fixed here:

build-deb.yml listed the built packages with ls, now find with an
explicit format.
test-python.yml and test-shell.yml split APT_PACKAGES unquoted, which
is deliberate and now says so with a directive and a reason.
lint.yml itself counted the workflows with ls in its summary, so the
gate began by catching the commit that introduced it.

Test plan

actionlint 1.7.7 over the five workflows: no findings, exit 0.
The digest in the workflow is the one of the release downloaded here:
023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757.
The reusable workflows keep their inputs and job ids, so no caller changes
and no status check is renamed.
After merge: make lint / actionlint required on main.

This repository holds the four reusable workflows the whole organization calls at `@main`, and it was the only active repository with no check of its own and no protection on its default branch. A mistake pushed here breaks every gate at once, and nothing downstream catches it: a caller only learns that its check failed to start. `lint.yml` runs actionlint, pinned by version and sha256 the way `test-shell` pins kcov. It parses each workflow, checks expressions, runner labels (`.github/actionlint.yaml` declares `keel-lxc`) and action inputs, and runs shellcheck over every `run` block. Any report fails the job, informational ones included: four workflows that lint clean is a state worth defending, and a tolerated info line is how the first real warning gets lost. Four findings, all real, all fixed here: - `build-deb.yml` listed the built packages with `ls`, now `find` with an explicit format. - `test-python.yml` and `test-shell.yml` split `APT_PACKAGES` unquoted, which is deliberate and now says so with a directive and a reason. - `lint.yml` itself counted the workflows with `ls` in its summary, so the gate began by catching the commit that introduced it. ## Test plan - actionlint 1.7.7 over the five workflows: no findings, exit 0. - The digest in the workflow is the one of the release downloaded here: `023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757`. - The reusable workflows keep their inputs and job ids, so no caller changes and no status check is renamed. - After merge: make `lint / actionlint` required on `main`.