ci: lint workflows with actionlint

.github/workflows/lint.yml

@@ -0,0 +1,31 @@
+name: Lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions: {}
+
+# Cancelling a push to main would leave that commit unlinted.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # required for checkout
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          minimum_release_age: 7d
+      - name: Run lint
+        run: mise run lint

CONTRIBUTING.md

@@ -13,3 +13,19 @@ bash scripts/compute-workflow-sha256.sh
 This regenerates `<name>/workflow-sha256`, a checksum of the workflow file. Commit the resulting diff alongside your workflow change — this is what makes the change visible to release-please for that Component.
 
 CI enforces this on every pull request via `bash scripts/compute-workflow-sha256.sh --check`, which fails if any `workflow-sha256` file is out of date.
+
+## Linting
+
+Workflows are linted with [actionlint](https://github.com/rhysd/actionlint), which also runs [shellcheck](https://github.com/koalaman/shellcheck) on inline `run:` scripts. Shell scripts committed to the repository (`*.sh`, e.g. under `scripts/`) are linted with shellcheck directly. Both tools are pinned in `mise.toml` and `mise.lock`. Install them with [mise](https://mise.jdx.dev):
+
+```sh
+mise install --locked
+```
+
+Then:
+
+```sh
+mise run lint
+```
+
+CI runs the same command on every pull request and on every push to `main`.

mise.toml

@@ -0,0 +1,17 @@
+[settings]
+minimum_release_age = "7d"
+lockfile = true
+
+[tools]
+"aqua:actionlint" = "1.7.12"
+"aqua:koalaman/shellcheck" = "0.11.0"
+
+[tasks."lint:actionlint"]
+run = "actionlint"
+
+[tasks."lint:shellcheck"]
+shell = "bash -euo pipefail -c"
+run = "git ls-files -z --cached --others --exclude-standard '*.sh' | xargs -0 -r shellcheck"
+
+[tasks.lint]
+depends = [ "lint:actionlint", "lint:shellcheck" ]

scripts/check-release-please-config.sh

@@ -40,6 +40,7 @@ fi
 # --- root key ordering: $schema first, lexicographic, packages last ---
 mapfile -t root_keys < <(jq -r 'keys_unsorted[]' "$CONFIG")
 
+# shellcheck disable=SC2016 # literal key name, not an expansion
 if [[ "${root_keys[0]-}" != '$schema' ]]; then
   say_err "root key order: first key must be \"\$schema\" (got \"${root_keys[0]-<none>}\")"
   ((failures += 1))
@@ -52,6 +53,7 @@ fi
 
 mid_keys=()
 for k in "${root_keys[@]}"; do
+  # shellcheck disable=SC2016 # literal key name, not an expansion
   [[ "$k" == '$schema' || "$k" == 'packages' ]] && continue
   mid_keys+=("$k")
 done

scripts/compute-workflow-sha256.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -uo pipefail
 
-cd "$(dirname "$0")/.."
+cd "$(dirname "$0")/.." || exit 1
 
 check=false
 if [[ "${1:-}" == "--check" ]]; then