chore(ci): switch to jactionlint v2

[jdx]

https://entire.io/gh/jdx/demand/trails/26

Workflow linting moves from jactionlint v1 to jactionlint v2, run with its default (strict) profile. This repo has no zizmor, so nothing is removed.

For contributors

• hk check --all (or hk fix --all to apply safe fixes) lints .github/workflows/*, .github/actions/**/action.y*ml and .github/dependabot.y*ml. The hk step gains a fix that runs jactionlint --fix.
• The default profile now enforces pinned actions, permissions:, timeout-minutes, concurrency:, persist-credentials: false and the other security and policy rules.

What changed

• jactionlint is locked at 2.0.2. That is below mise's default minimum release age, so the entry carries minimum_release_age = "0s" like hk; drop it once 2.0.2 has aged.
• Findings with the default profile: 10 before, 0 after.
• jactionlint --fix added persist-credentials: false to 3 checkouts.
• Added workflow-level permissions: contents: read to test.yml (nothing there needs more), a concurrency: group to release-plz.yml that queues instead of cancelling a running release, and timeout-minutes to the test, release-plz and auto-merge-release jobs (30, 30 and 10 minutes).

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: claude-code_2-1-293_agent.
🤖 Generated with Claude Code

---

Note

Low Risk
CI and developer-tooling only; changes tighten GitHub Actions hygiene without altering application runtime behavior.

Overview
Upgrades workflow linting to jactionlint v2 (locked at 2.0.2 in mise.lock, with minimum_release_age = "0s" in mise.toml until the release ages).

hk.pkl now runs jactionlint on workflows, composite actions, and Dependabot configs, and adds a jactionlint --fix path via hk fix. The v2 default profile drove workflow policy fixes: permissions: contents: read on test.yml, concurrency on release-plz.yml (queue, don’t cancel in-flight releases), timeout-minutes on test/release/auto-merge jobs, and persist-credentials: false on checkout steps (including auto-applied fixes).

^{Reviewed by Cursor Bugbot for commit 16b568c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Chores
  • Added time limits to release, merge, and test automation.
  • Serialized release workflow runs and tightened workflow permissions.
  • Disabled credential persistence during workflow checkouts.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1d470fb3-fdb9-485d-9055-890321135443

---

📥 Commits

Reviewing files that changed from the base of the PR and between d3c8821 and 16b568c.

---

⛔ Files ignored due to path filters (2)

• hk.pkl is excluded by !**/*.pkl
• mise.lock is excluded by !**/*.lock

---

📒 Files selected for processing (4)

• .github/workflows/auto-merge-release.yml
• .github/workflows/release-plz.yml
• .github/workflows/test.yml
• mise.toml

---

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The workflows add job timeouts and checkout credential settings. The release-plz workflow serializes runs, and the test workflow grants contents read permission. The jactionlint tool configuration sets a zero-second minimum release age.

Changes

Workflow controls

Layer / File(s)	Summary
Release workflow controls .github/workflows/auto-merge-release.yml, .github/workflows/release-plz.yml	The auto-merge job has a 10-minute timeout. The release-plz workflow serializes runs without canceling an in-progress run, sets a 30-minute job timeout, and disables persisted checkout credentials.
Test workflow permissions and checkout .github/workflows/test.yml	The workflow grants contents: read, sets the test job timeout to 30 minutes, and disables persisted checkout credentials in the test and semver jobs.

Tool configuration

Layer / File(s)	Summary
jactionlint release settings mise.toml	The jactionlint dependency retains version = "latest" and sets minimum_release_age = "0s".

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

---

Merge Risk: ⚪ Minimal · up to 16b56

The workflow changes preserve the configured release, test, and semver operations. No material merge risk is established.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the main change: updating CI workflow linting to jactionlint v2.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[High impact] This PR appears safe to merge; no actionable defects were found.

Summary

Upgrades jactionlint to 2.0.2 and updates workflows for its default checks.

• Contributors can lint workflow, action, and Dependabot YAML.
• Test runs have read-only access and a 30-minute limit.
• Release runs queue instead of cancelling and have time limits.

No actionable issues were found.

_{Reviews (1) · Last reviewed commit: "chore(ci): switch to jactionlint v2" · Reviewed by Greptile}