Repository navigation
ci: actionlint has a maintained config in-tree but never runs #3641
Description
Activity
The config is referenced from a comment in
.github/workflows/e2e-fork.yaml, which is why it reads as active. That comment and the file itself are the only two mentions of the name in the tree, and it is not in.pre-commit-config.yamleither, so there is no local hook path.Recent work on the backport workflow turned up the kind of defect actionlint catches: an expression whose operator precedence made a guard vacuous, and a condition reading a context that is empty for the event it fires on. Both were found by reading.
Two concrete instances with line numbers, since the breakdown above counts codes but names no location.
actionlinton.github/workflows/backport.yamlreports, both at234:9inside theSet target branchstep'srun:block:SC2086:info:2:64: Double quote to prevent globbing and word splitting SC2086:info:5:65: Double quote to prevent globbing and word splittingBoth are
echo "branch=..." >> $GITHUB_OUTPUTwith$GITHUB_OUTPUTunquoted. Harmless in themselves: the variable is set by the runner and holds a path without whitespace or globs, and the interpolated branch names are constrained to^release-(\d+)\.(\d+)$by the anchored regex that produces them.They are worth recording here rather than fixing in passing, because they are the shape this issue is about. Both have been present since the file was written, both survive every gate the repository runs, and I only saw them by invoking
actionlintby hand while working on that file. Anything of the same class in a workflow nobody happens to open stays invisible.
Summary
The repository carries an actionlint config (
.github/actionlint.yaml, maintained — its comment asks to keep the label list in sync), but no workflow, Makefile target, or hack script ever runs actionlint. The only workflow linter that actually runs in CI is zizmor, whose scope is security audits, not correctness. So the config promises a check that does not exist.Running actionlint against the current main tip (605030b) produces 45 findings, all forwarded from shellcheck at info/style level: 42 SC2086 word-splitting warnings, 2 SC2016, 1 SC2129, spread over 7 workflow files. actionlint's own checks (expression syntax,
needs:references, action inputs) are clean today, which is exactly the state worth locking in before it drifts.Why it matters
Workflow YAML is one of the highest-blast-radius file classes in the repo (release, promotion, e2e selection), and today typos in expressions, wrong
needs:references, and unquoted expansions are caught only by breaking a live run. A maintained-but-never-executed linter config is worse than no config: it signals coverage that is not there.Fix shape
Either wire actionlint into CI (a small job on
pull_requesttouching.github/workflows/**, after fixing or baselining the 45 current shellcheck-level findings), or delete.github/actionlint.yamlso the tree stops claiming a check it does not run.