ci: lint workflows with actionlint

Add a Lint workflow that runs `mise run lint` on pushes to main and on
pull requests. actionlint and shellcheck are pinned in mise.toml and
mise.lock.

Document the local linting commands in CONTRIBUTING.md.

Author: PierreJeanjacquot

.github/workflows/lint.yml

@@ -0,0 +1,31 @@
+name: Lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions: {}
+
+# Cancelling a push to main would leave that commit unlinted.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # required for checkout
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          minimum_release_age: 7d
+      - name: Run lint
+        run: mise run lint

CONTRIBUTING.md

@@ -13,3 +13,19 @@ bash scripts/compute-workflow-sha256.sh
 This regenerates `<name>/workflow-sha256`, a checksum of the workflow file. Commit the resulting diff alongside your workflow change — this is what makes the change visible to release-please for that Component.
 
 CI enforces this on every pull request via `bash scripts/compute-workflow-sha256.sh --check`, which fails if any `workflow-sha256` file is out of date.
+
+## Linting
+
+Workflows are linted with [actionlint](https://github.com/rhysd/actionlint), which also runs [shellcheck](https://github.com/koalaman/shellcheck) on `run:` scripts. Both tools are pinned in `mise.toml` and `mise.lock`. Install them with [mise](https://mise.jdx.dev):
+
+```sh
+mise install --locked
+```
+
+Then:
+
+```sh
+mise run lint
+```
+
+CI runs the same command on every pull request and on every push to `main`.

mise.lock

@@ -0,0 +1,13 @@
+[settings]
+minimum_release_age = "7d"
+lockfile = true
+
+[tools]
+"aqua:actionlint" = "1.7.12"
+"aqua:koalaman/shellcheck" = "0.11.0"
+
+[tasks."lint:actionlint"]
+run = "actionlint"
+
+[tasks.lint]
+depends = [ "lint:actionlint" ]