From a39a5537a793b7665c7a5bb8ef3a1c1c57dc718d Mon Sep 17 00:00:00 2001 From: jdx <216188+jdx@users.noreply.github.com> Date: Fri, 9 Oct 2026 20:03:24 +0000 Subject: [PATCH 1/4] chore(ci): switch to jactionlint v2 Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/ci.yml | 4 ++++ hk.pkl | 13 +++++++++--- mise.lock | 46 ++++++++++++++++++++-------------------- mise.toml | 2 +- 4 files changed, 38 insertions(+), 27 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0f167dd..f09cc02 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,6 +8,10 @@ on: permissions: contents: read +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + jobs: lint: runs-on: ubuntu-latest diff --git a/hk.pkl b/hk.pkl index b7bcd52..a05c0c2 100644 --- a/hk.pkl +++ b/hk.pkl @@ -1,5 +1,5 @@ -amends "package://github.com/jdx/hk/releases/download/v1.18.1/hk@1.18.1#/Config.pkl" -import "package://github.com/jdx/hk/releases/download/v1.18.1/hk@1.18.1#/Builtins.pkl" +amends "package://github.com/jdx/hk/releases/download/v2.5.0/hk@2.5.0#/Config.pkl" +import "package://github.com/jdx/hk/releases/download/v2.5.0/hk@2.5.0#/Builtins.pkl" local linters = new Mapping { ["lua-check"] { @@ -15,7 +15,14 @@ local linters = new Mapping { ["jactionlint"] { glob = List(".github/workflows/*.yml", ".github/workflows/*.yaml") batch = true - check = "jactionlint {{files}}" + check = new CommandSpec { + command = "jactionlint {{ files }}" + effect = "read" + } + fix = new CommandSpec { + command = "jactionlint --fix {{ files }}" + effect = "write" + } } } diff --git a/mise.lock b/mise.lock index cdf561b..8c61992 100644 --- a/mise.lock +++ b/mise.lock @@ -44,50 +44,50 @@ signer = "sigstore-oidc:https://github.com/jdx/hk/.github/workflows/release.yml" repository_ids = { repository = "922514152" } [[tools.jactionlint]] -version = "1.8.2" +version = "2.0.2" backend = "github:jdx/jactionlint" -specifiers = ["latest"] +specifiers = ["2"] [tools.jactionlint."platforms.linux-arm64"] -checksum = "sha256:7d618749dbddd762a14bd491ea97bc4f6599626f830a11edc6c6522ead8bcd05" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338576" +checksum = "sha256:978a9f32cc4ed1d81b94563fc49643b8b3a48dcba4d1ea089d9ba05f7e17e7a7" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020784" provenance = "github-attestations" [tools.jactionlint."platforms.linux-arm64-musl"] -checksum = "sha256:7d618749dbddd762a14bd491ea97bc4f6599626f830a11edc6c6522ead8bcd05" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338576" +checksum = "sha256:978a9f32cc4ed1d81b94563fc49643b8b3a48dcba4d1ea089d9ba05f7e17e7a7" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020784" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64"] -checksum = "sha256:6533bd8047fc012a3f66238d84f65cacdac669da00b9f6cf042c1734c252bc93" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338580" +checksum = "sha256:026bce6d0ef196f5b22bf43acb1348d47c5d0a5ae61d6ec3bdba1229a823161b" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020780" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64-musl"] -checksum = "sha256:6533bd8047fc012a3f66238d84f65cacdac669da00b9f6cf042c1734c252bc93" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338580" +checksum = "sha256:026bce6d0ef196f5b22bf43acb1348d47c5d0a5ae61d6ec3bdba1229a823161b" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020780" provenance = "github-attestations" [tools.jactionlint."platforms.macos-arm64"] -checksum = "sha256:de9eb05af3cde409dc0b37fe2fd6a21b875a575374e7b26c02d45a7086645c28" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_darwin_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338605" +checksum = "sha256:1ad210bd21f4c70a81e0bffecc6d223daca8dd13e57fa6899787064f8b724c7c" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_darwin_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020734" provenance = "github-attestations" [tools.jactionlint."platforms.macos-x64"] -checksum = "sha256:42790b2565759b7f4a81696fb9034b2060f97f551d2ced54cf722c9de9abe6b2" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_darwin_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338604" +checksum = "sha256:03ccb52f3bf3c6b1b6358689a4d31e5f05d558b32c0b8edaeac7c452abe7fff4" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_darwin_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020732" provenance = "github-attestations" [tools.jactionlint."platforms.windows-x64"] -checksum = "sha256:fd7be539cd3276d5178f85ef140c1bb52395b1ec1f59b1585050e1be3b0b194b" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_windows_amd64.zip" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338616" +checksum = "sha256:988403508761b96fa506920b7db420e6e738247aade084f9b928f452340c8f8f" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_windows_amd64.zip" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020828" provenance = "github-attestations" [[tools.lua]] diff --git a/mise.toml b/mise.toml index 855b626..371ea92 100644 --- a/mise.toml +++ b/mise.toml @@ -3,7 +3,7 @@ MISE_USE_VERSIONS_HOST = "0" [tools] hk = "latest" -jactionlint = "latest" +jactionlint = { version = "2", minimum_release_age = "0s" } lua = "5.4" lua-language-server = "latest" pkl = "latest" From 45dff9ac665896dc301675c48dc8a562582094ca Mon Sep 17 00:00:00 2001 From: jdx <216188+jdx@users.noreply.github.com> Date: Sat, 10 Oct 2026 12:35:22 +0000 Subject: [PATCH 2/4] fix(ci): pin jactionlint 2.0.2 exactly instead of overriding minimum_release_age Co-Authored-By: Claude Sonnet 5.5 --- mise.lock | 2 +- mise.toml | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/mise.lock b/mise.lock index 8c61992..55c20e5 100644 --- a/mise.lock +++ b/mise.lock @@ -46,7 +46,7 @@ repository_ids = { repository = "922514152" } [[tools.jactionlint]] version = "2.0.2" backend = "github:jdx/jactionlint" -specifiers = ["2"] +specifiers = ["2.0.2"] [tools.jactionlint."platforms.linux-arm64"] checksum = "sha256:978a9f32cc4ed1d81b94563fc49643b8b3a48dcba4d1ea089d9ba05f7e17e7a7" diff --git a/mise.toml b/mise.toml index 371ea92..76d593d 100644 --- a/mise.toml +++ b/mise.toml @@ -3,7 +3,8 @@ MISE_USE_VERSIONS_HOST = "0" [tools] hk = "latest" -jactionlint = { version = "2", minimum_release_age = "0s" } +# Exact pin: jactionlint 2.0.2 is newer than the default 24h release-age holdback until 2026-10-10 20:00Z. Loosen to the previous selector after that. +jactionlint = "2.0.2" lua = "5.4" lua-language-server = "latest" pkl = "latest" From bf2d2881c389d2eba1fdb253c1dc3335a1899ab0 Mon Sep 17 00:00:00 2001 From: jdx <216188+jdx@users.noreply.github.com> Date: Sat, 10 Oct 2026 14:03:14 +0000 Subject: [PATCH 3/4] chore(ci): bump jactionlint to 2.1.0 and run its online checks in CI Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/ci.yml | 4 ++++ mise.lock | 46 ++++++++++++++++++++-------------------- mise.toml | 3 +-- 3 files changed, 28 insertions(+), 25 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f09cc02..e715b7e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,3 +22,7 @@ jobs: persist-credentials: false - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 - run: mise x hk -- hk check --all + env: + # jactionlint's online checks (known-vulnerable actions, impostor commits, stale refs) run in CI only. + JACTIONLINT_ONLINE: 1 + GITHUB_TOKEN: ${{ github.token }} diff --git a/mise.lock b/mise.lock index 55c20e5..47ff4bd 100644 --- a/mise.lock +++ b/mise.lock @@ -44,50 +44,50 @@ signer = "sigstore-oidc:https://github.com/jdx/hk/.github/workflows/release.yml" repository_ids = { repository = "922514152" } [[tools.jactionlint]] -version = "2.0.2" +version = "2.1.0" backend = "github:jdx/jactionlint" -specifiers = ["2.0.2"] +specifiers = ["2.1.0"] [tools.jactionlint."platforms.linux-arm64"] -checksum = "sha256:978a9f32cc4ed1d81b94563fc49643b8b3a48dcba4d1ea089d9ba05f7e17e7a7" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020784" +checksum = "sha256:ec0c6496d8a2f37b2ae2a1af0fbf98d58df1f7c98a27cf9fdd64c20ad317234b" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_linux_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112146" provenance = "github-attestations" [tools.jactionlint."platforms.linux-arm64-musl"] -checksum = "sha256:978a9f32cc4ed1d81b94563fc49643b8b3a48dcba4d1ea089d9ba05f7e17e7a7" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020784" +checksum = "sha256:ec0c6496d8a2f37b2ae2a1af0fbf98d58df1f7c98a27cf9fdd64c20ad317234b" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_linux_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112146" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64"] -checksum = "sha256:026bce6d0ef196f5b22bf43acb1348d47c5d0a5ae61d6ec3bdba1229a823161b" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020780" +checksum = "sha256:baebfc5792135438fb3bb5ea266c3bf2538a089753616f1988ef618e4c0c3cb1" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112089" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64-musl"] -checksum = "sha256:026bce6d0ef196f5b22bf43acb1348d47c5d0a5ae61d6ec3bdba1229a823161b" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020780" +checksum = "sha256:baebfc5792135438fb3bb5ea266c3bf2538a089753616f1988ef618e4c0c3cb1" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112089" provenance = "github-attestations" [tools.jactionlint."platforms.macos-arm64"] -checksum = "sha256:1ad210bd21f4c70a81e0bffecc6d223daca8dd13e57fa6899787064f8b724c7c" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_darwin_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020734" +checksum = "sha256:3766a4b0890d3eb36fe58760289885712131c7974de4bc9fabb9a3faa599e931" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_darwin_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628111988" provenance = "github-attestations" [tools.jactionlint."platforms.macos-x64"] -checksum = "sha256:03ccb52f3bf3c6b1b6358689a4d31e5f05d558b32c0b8edaeac7c452abe7fff4" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_darwin_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020732" +checksum = "sha256:a88f2be76def62dd4fd9aed38c81d0db4144763012128a89800be80b1ee82e89" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_darwin_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112083" provenance = "github-attestations" [tools.jactionlint."platforms.windows-x64"] -checksum = "sha256:988403508761b96fa506920b7db420e6e738247aade084f9b928f452340c8f8f" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_windows_amd64.zip" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020828" +checksum = "sha256:5925a118df6db8c5be418acb05bd815d3c14ca98d91a9ecba6156753b87d4ae7" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_windows_amd64.zip" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112198" provenance = "github-attestations" [[tools.lua]] diff --git a/mise.toml b/mise.toml index 76d593d..87fbabe 100644 --- a/mise.toml +++ b/mise.toml @@ -3,8 +3,7 @@ MISE_USE_VERSIONS_HOST = "0" [tools] hk = "latest" -# Exact pin: jactionlint 2.0.2 is newer than the default 24h release-age holdback until 2026-10-10 20:00Z. Loosen to the previous selector after that. -jactionlint = "2.0.2" +jactionlint = "2.1.0" lua = "5.4" lua-language-server = "latest" pkl = "latest" From 1eafe5378d4143a1941a6c5d3cd4e3b7c4fc5a33 Mon Sep 17 00:00:00 2001 From: jdx <216188+jdx@users.noreply.github.com> Date: Sat, 10 Oct 2026 14:07:45 +0000 Subject: [PATCH 4/4] chore(ci): track latest jactionlint, locked at 2.1.0 Co-Authored-By: Claude Sonnet 5.5 --- mise.lock | 2 +- mise.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/mise.lock b/mise.lock index 47ff4bd..fe051ef 100644 --- a/mise.lock +++ b/mise.lock @@ -46,7 +46,7 @@ repository_ids = { repository = "922514152" } [[tools.jactionlint]] version = "2.1.0" backend = "github:jdx/jactionlint" -specifiers = ["2.1.0"] +specifiers = ["latest"] [tools.jactionlint."platforms.linux-arm64"] checksum = "sha256:ec0c6496d8a2f37b2ae2a1af0fbf98d58df1f7c98a27cf9fdd64c20ad317234b" diff --git a/mise.toml b/mise.toml index 87fbabe..855b626 100644 --- a/mise.toml +++ b/mise.toml @@ -3,7 +3,7 @@ MISE_USE_VERSIONS_HOST = "0" [tools] hk = "latest" -jactionlint = "2.1.0" +jactionlint = "latest" lua = "5.4" lua-language-server = "latest" pkl = "latest"