ci: make actionlint workflow dispatch-only

[michen00]

Summary

• Limit lint-github-actions.yml to workflow_dispatch and drop path-filter plumbing; pin Docker actionlint to v1.7.12 (matches .pre-commit-config.yaml).
• Update bot-automerge.yml comments for eight required contexts (no separate actionlint check).
• Document the optional workflow in CI.instructions.md.
• Already applied on the repo: removed actionlint from the main-protect ruleset required status checks via API (eight contexts: three pre-commit + five tests).

Test plan

• CI pre-commit matrix still passes (includes actionlint hook).
• Optional: run lint GitHub Actions workflows from Actions → workflow_dispatch.

[qodo-code-review]

PR Summary by Qodo

CI: make actionlint workflow dispatch-only and pin version

⚙️ Configuration changes 📝 Documentation 🕐 10-20 Minutes

AI Description

• Restrict GitHub Actions workflow linting to manual workflow_dispatch runs.
• Keep actionlint enforcement via pre-commit CI; pin actionlint Docker image to v1.7.12.
• Align bot auto-merge documentation with updated required status-check contexts.

Diagram

graph TD
  PR["Pull request / push"] --> CI["CI: pre-commit matrix"] --> Ruleset["main-protect required checks"]
  CI --> Hook["pre-commit: actionlint hook"]
  Manual["Manual run"] --> LintWF["lint-github-actions.yml"] --> AL["actionlint Docker v1.7.12"]
  Bot["bot-automerge.yml"] --> Ruleset

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Keep PR/push triggers with path filtering

• ➕ Catches workflow-lint failures immediately on workflow changes without manual action
• ➕ Provides a dedicated status check that is visible per PR
• ➖ Extra CI noise/cost for repos already enforcing actionlint via pre-commit
• ➖ Path-filter plumbing adds complexity and can miss edge cases (renames/indirect changes)
• ➖ If required as a ruleset check, can block merges for an otherwise redundant signal

2. Remove the standalone actionlint workflow entirely

• ➕ Simplifies workflow inventory and reduces maintenance surface
• ➕ Avoids duplicated tooling/config between CI and a separate workflow
• ➖ No on-demand, UI-triggerable actionlint run for debugging outside the full CI matrix
• ➖ Harder to run actionlint quickly without cloning and running pre-commit locally

Recommendation: The current approach is a good balance: keep enforcement in the pre-commit CI (single source of truth) while retaining a manual workflow for ad-hoc validation. Pinning the actionlint image version reduces drift versus the pre-commit hook and improves reproducibility.

Files changed (3) +13 / -29

Documentation (1) +8 / -0

CI.instructions.mdDocument optional manual actionlint workflow +8/-0

Document optional manual actionlint workflow

• Adds CI documentation describing the dedicated actionlint workflow, its purpose, and its 'workflow_dispatch'-only trigger. Clarifies that merge enforcement is handled via the pre-commit hook in CI rather than a required workflow run.

.github/instructions/CI.instructions.md

Other (2) +5 / -29

bot-automerge.ymlUpdate required-context comments from nine to eight +4/-4

Update required-context comments from nine to eight

• Updates inline documentation to reflect that 'main-protect' now requires eight contexts (three pre-commit + five tests) and no longer lists a separate 'actionlint' context. No functional workflow logic changes are introduced here.

.github/workflows/bot-automerge.yml

lint-github-actions.ymlMake actionlint workflow dispatch-only and pin actionlint image +1/-25

Make actionlint workflow dispatch-only and pin actionlint image

• Removes pull_request/push triggers and path-filter gating so the workflow runs only via 'workflow_dispatch'. Pins the actionlint Docker image to 'rhysd/actionlint:v1.7.12' for deterministic lint results aligned with pre-commit.

.github/workflows/lint-github-actions.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}