# Validates GitHub Actions workflow YAML. See GIT_FLOW.md automation surface.
name: actionlint

on:
  pull_request:
    paths:
      - '.github/workflows/**'
      - '.github/actionlint.yaml'
  push:
    branches: [main]
    paths:
      - '.github/workflows/**'
  schedule:
    - cron: '0 6 * * 1'   # Monday 06:00 UTC, drift catcher
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # Named `actionlint`, not `lint`: `CI - Core` already has a job called `lint`,
  # and branch protection matches a required check by name alone. Two jobs
  # reporting the same context made `lint` ambiguous -- whichever reported last
  # answered for both, so a red one could be masked by a green one from the
  # other workflow. This job stays advisory (it is path-filtered, so it cannot
  # be required without hanging PRs that touch no workflow); `lint` now belongs
  # unambiguously to `CI - Core`.
  actionlint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Download actionlint
        id: get_actionlint
        shell: bash
        run: bash <(curl -sSfL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
      - name: Lint workflows
        shell: bash
        # -shellcheck= disables shellcheck integration: this gate validates
        # workflow YAML, expressions, and action refs (its stated purpose), not
        # shell style inside run: blocks. actionlint's own checks (incl.
        # script-injection [expression]) stay active.
        run: ${{ steps.get_actionlint.outputs.executable }} -color -shellcheck=