feat: standards-check.yml, the deterministic required check (W1)

[twistedmelonman]

What this is

The deterministic, secret-free standards check that becomes the fleet's required check, replacing the CI judgment reviewer outright (dev-env#60, #154; decided 2026-09-08).

It is a reusable workflow. It installs pinned, checksum-verified linters, then runs standards/run-standards.sh from this repo at the SHA of the workflow file itself — so the script, the configs, and the workflow always agree, and a consumer can never drift onto a mismatched pair.

Unlike the judgment reviewer it replaces, it consumes no secrets, calls no model, and returns the same verdict for the same tree every time.

The caller stub

Consumers add one file. Name the job standards-check, and the required check is standards-check / run-standards-check:

name: Standards Check
on:
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened]
permissions:
  contents: read
jobs:
  standards-check:
    uses: smartwatermelon/github-workflows/.github/workflows/standards-check.yml@standards-check-v1

self-standards-check.yml in this PR is that stub pointed at a local path, so a PR that changes the check dogfoods itself.

Inputs

Input	Type	Default	Effect
shellcheck	boolean	true	shellcheck -S info over shell files
yamllint	boolean	true	yamllint over YAML files
actionlint	boolean	true	actionlint over .github/workflows
zizmor	boolean	true	zizmor over .github/workflows
markdownlint	boolean	true	markdownlint-cli2 over Markdown
node_floor_check	boolean	true	Fail on Node pins below node_floor
node_floor	string	"22"	Lowest supported Node major

Setting a linter's input to false skips both its install and its run.

Pinned tools

Every version is pinned here and bumped by PR. The three binaries are additionally SHA256-verified before install.

Tool	Version	Verification
shellcheck	0.11.0	SHA256
actionlint	1.7.12	SHA256
zizmor	1.30.0	SHA256
yamllint	1.38.0	pinned via pipx
markdownlint-cli2	0.23.2	pinned via npm

Running it locally

The same script CI runs:

bash standards/run-standards.sh --repo /path/to/repo

Design decisions worth review

Three deviations from the drafted design, each verified rather than assumed:

1. job.workflow_sha, not github.job_workflow_sha. The draft used the latter. It is absent from the current contexts reference and evaluates to an empty string (Property job_workflow_sha in context github is not available actions/runner#2417). Empty is the dangerous value: actions/checkout treats an empty ref as the default branch, so the check would have gone green having linted a different commit than the one under review. A separate step now resolves the SHA and exits 2 when it is empty, so a runner-side regression fails loudly instead of silently linting the wrong tree.

2. A scoped actionlint.yaml ignore. actionlint 1.7.12 has not added job.workflow_sha to its context schema, so it reports the property as undefined. The ignore is scoped to that one message in that one file, and the scoping was validated against a known-bad case — an unrelated bogus property in the same file is still reported.

3. SKIP_LIST split per linter. The single concatenated expression was 346 columns, over the shared 120-column yamllint limit. Widening that limit would have weakened it fleet-wide, so the list is now one env var per linter joined in the shell. The join was exercised for the all-empty, partial, all-set, and trailing-element cases.

Also included: a fix for two review findings from the earlier commits — run-standards.sh reported a clean pass over any directory git could not read (it now exits 2), and the test fixtures inherited the user's global git template instead of being hermetic.

Validation

Read from the run log, not inferred from the green check.

standards-check / run-standards-check passed in 16s.

All three checksums verified:

/tmp/shellcheck.tar.xz: OK
/tmp/actionlint.tar.gz: OK
/tmp/zizmor.tar.gz: OK

All six linters ran (skip list: '' — nothing skipped, every input defaulted true):

== shellcheck
== yamllint
== actionlint
== zizmor
== markdownlint
== node-floor
Node floor 22: OK
standards-check: all enabled linters clean

The standards checkout resolved the right commit. The log reports:

standards SHA: efab72221e5933ffe4b6f65cb4ac61d0267b916f

That commit is Merge 535b88f into 39d1b15 — the PR head merged into main, confirmed by its two parents and by the PR's own potentialMergeCommit. For a pull_request trigger that is the correct ref: it carries this PR's content tested against the merge target. It is not origin/main (39d1b15), which rules out the silent default-branch fallback that the empty-SHA guard exists to prevent.

This is the end-to-end confirmation that job.workflow_sha populates at runtime where github.job_workflow_sha would have been empty.

Advances #154

https://claude.ai/code/session_019HDRKLQNv82SEBd4zGpcXf