actionlint.yml

name: GitHub Action Lint
on:
  pull_request:
    paths:
      - ".github/**/*"



permissions:
  contents: read

env:
  ACTIONLINT_VERSION: "1.6.17"
  ACTIONLINT_SHA256: "a4641cd9b81e06070936fa017feb1f4f69cec0ceed41f00072e94910beb6bdd7"

jobs:
  actionlint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Download actionlint
        run: |
          curl -s -L -o actionlint.tar.gz "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          if ! sha256sum actionlint.tar.gz | grep "${ACTIONLINT_SHA256}"; then
            echo "Checksum verification failed. Please make sure that nobody tampered with the releases of github.com/rhysd/actionlint"
            echo "Actual checksum: "
            sha256sum actionlint.tar.gz
            exit 1
          fi
          tar -ztvf actionlint.tar.gz
          tar xvzf actionlint.tar.gz actionlint
        shell: bash
      - name: Check workflow files
        run: ./actionlint -color
        shell: bash