chore(ci): switch to jactionlint v2

.github/jactionlint.yaml

@@ -0,0 +1,5 @@
+ignores:
+  - rule: stale-action-refs
+    uses: dtolnay/rust-toolchain
+    file: .github/workflows/release-plz.yml
+    reason: dtolnay/rust-toolchain publishes the toolchain as the `stable` branch and tags only specific Rust versions, so the stable head never has a tag; the pin is the current head of that branch

.github/workflows/auto-merge-release.yml

@@ -22,6 +22,7 @@ jobs:
   merge:
     if: github.repository == 'jdx/demand'
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:

.github/workflows/release-plz.yml

@@ -5,19 +5,27 @@ on:
     branches:
       - main
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: {}
+
+# Never cancel a release that is already running.
+concurrency:
+  group: release-plz
+  cancel-in-progress: false
 
 jobs:
   release-plz:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 0
-      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
-      - uses: release-plz/action@b8d6b54b02889ff2ae2bb82e8b57c3a8fc1683a5 # v0.5
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
+      - uses: release-plz/action@b8d6b54b02889ff2ae2bb82e8b57c3a8fc1683a5 # v0.5.139
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.github/workflows/test.yml

@@ -3,29 +3,41 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+permissions:
+  contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 jobs:
   test:
     runs-on: ${{ matrix.platform }}
+    timeout-minutes: 30
     strategy:
       matrix:
         platform: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-      - uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5
+      - uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
       - run: cargo clippy -- -D warnings
       - run: cargo fmt -- --check
       - run: cargo test --lib --tests
+      # Online checks (known-vulnerable actions, impostor commits, stale refs) run
+      # in CI only; locally: JACTIONLINT_ONLINE=1 hk check --all
       - run: hk check --all
+        env:
+          JACTIONLINT_ONLINE: 1
+          GITHUB_TOKEN: ${{ github.token }}
 
   semver:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2.9
 
   test-ci:

hk.pkl

@@ -13,14 +13,18 @@ local linters = new Mapping<String, Step> {
             effect = "write"
         }
     }
-    // lints GitHub Actions workflows (jdx/jactionlint, a maintained actionlint fork)
+    // lints GitHub Actions workflows (jdx/jactionlint)
     ["jactionlint"] {
-        glob = List(".github/workflows/*.yml", ".github/workflows/*.yaml")
+        glob = List(".github/workflows/*.yml", ".github/workflows/*.yaml", ".github/actions/**/action.yml", ".github/actions/**/action.yaml", ".github/dependabot.yml", ".github/dependabot.yaml")
         batch = true
         check = new CommandSpec {
             command = "jactionlint {{ files }}"
             effect = "read"
         }
+        fix = new CommandSpec {
+            command = "jactionlint --fix {{ files }}"
+            effect = "write"
+        }
     }
 }