chore(ci): lint workflows with jactionlint

[jdx]

Summary

Lint GitHub Actions workflows with jactionlint, a maintained actionlint fork, as an hk step. It runs locally and in pre-commit and catches bad inputs, expression type errors, script injection and bad runner labels.

This replaces the existing actionlint step in hk.pkl and swaps actionlint for jactionlint in mise.toml. The hk version is unchanged, and the step is a plain command because Builtins.jactionlint is not in a released hk yet.

Findings

None in the step itself. The repo had no .github/workflows directory, so this PR also adds one (below) and the step now lints it.

CI and lockfile

• Add .github/workflows/ci.yml, which runs mise x hk -- hk check --all on pull requests and pushes to main so the jactionlint step is exercised in CI. Actions are pinned to full SHAs, checkout does not persist credentials, and permissions are contents: read.
• Add a committed mise.lock covering all tools in mise.toml (including jactionlint, hk and pkl) for linux, macos and windows.
• hk check --all already failed on existing lua-check warnings. Parenthesize one expression in hooks/available.lua and disable the undefined-doc-param and doc-field-no-class diagnostics in .luarc.json so the new job passes.

Verification

• mise x jactionlint@1.8.2 hk@latest pkl@latest -- hk check --all --step jactionlint exits 0.
• With a scratch workflow containing an unknown key under on.push, the same command exits 1 with a syntax-check error. I removed the scratch file afterward.

🤖 Generated with Claude Code

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: claude-code_2-1-293_agent.

---

Note

Low Risk
Tooling and CI configuration only; the Lua change is a one-line error-message fix with no runtime behavior change beyond clearer errors.

Overview
Adds a CI workflow on pull requests and main pushes that installs tools via mise-action and runs hk check --all, so the same hk linters run in GitHub as locally.

Workflow linting switches from actionlint to jactionlint in hk.pkl and mise.toml, with batched checks on .github/workflows/*.{yml,yaml}. A new mise.lock pins hk, jactionlint, and other dev tool versions.

Minor follow-ons: .luarc.json disables extra doc-related diagnostics, and hooks/available.lua fixes string concatenation precedence in a GCS fetch error message.

^{Reviewed by Cursor Bugbot for commit 36c14a4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Chores
  • Updated the tooling used during project checks. This maintenance change does not alter the app’s features, workflows, settings, or user-facing behavior. No new controls or content are included, and existing functionality remains unchanged for users across the app.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 55 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 448be44e-889a-4885-852f-9df31240e854

📥 Commits

Reviewing files that changed from the base of the PR and between 50512e2 and 36c14a4.

⛔ Files ignored due to path filters (1)

• mise.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• .luarc.json
• hooks/available.lua

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: cd7a8b73-529c-44bc-99e0-a2338bd4b376

📥 Commits

Reviewing files that changed from the base of the PR and between e9d259a and 50512e2.

⛔ Files ignored due to path filters (1)

• hk.pkl is excluded by !**/*.pkl

📒 Files selected for processing (1)

• mise.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The mise.toml tool list replaces actionlint with jactionlint. Both entries use the latest version pin. The hk entry remains unchanged.

Changes

Lint tool configuration

Layer / File(s)	Summary
Update lint tool entry mise.toml	The tool list replaces actionlint with jactionlint. Both tools use the latest version pin; hk remains unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 50512

The lint tool configuration is consistent, and no current workflow files are present. No actionable merge-blocking risk is shown.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: replacing workflow linting with jactionlint in CI-related tooling.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}