fix(ci): lint workflow changes with actionlint (#2742)

* fix(ci): lint workflow changes with actionlint * fix(ci): lint workflow changes with actionlint Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode) * fix(ci): lint workflow changes with actionlint Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode) * fix(ci): lint workflow changes with actionlint Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode)
2026-05-31 19:04:39 +07:00 · 2026-05-23 12:12:55 +08:00 · 2026-05-23 12:12:55 +08:00 · 135c6b42d8
commit 135c6b42d8
parent 866661ac65
7 changed files with 57 additions and 21 deletions
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@ -0,0 +1,28 @@
+name: actionlint
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/**
+  push:
+    branches:
+      - main
+    paths:
+      - .github/workflows/**
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    name: Lint GitHub Actions workflows
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+
+      - name: Check workflow files
+        uses: docker://rhysd/actionlint:1.7.12
+        with:
+          args: -color
--- a/.github/workflows/blog-3day-report.yml
+++ b/.github/workflows/blog-3day-report.yml
@ -87,9 +87,11 @@ jobs:
          if [ -n "$FEISHU_BLOG_DIGEST_WEBHOOK" ]; then
            feishu=true
          fi
-          echo "gsc=$gsc" >> "$GITHUB_OUTPUT"
-          echo "bot=$bot" >> "$GITHUB_OUTPUT"
-          echo "feishu=$feishu" >> "$GITHUB_OUTPUT"
+          {
+            echo "gsc=$gsc"
+            echo "bot=$bot"
+            echo "feishu=$feishu"
+          } >> "$GITHUB_OUTPUT"
          {
            echo "### Blog 3-day report configuration"
            echo "- GSC auth configured: \`$gsc\`"
@ -122,16 +124,16 @@ jobs:
          GSC_SERVICE_ACCOUNT_KEY: ${{ secrets.GSC_SERVICE_ACCOUNT_KEY }}
        run: |
          mkdir -p .blog-indexing
-          flags=""
+          flags=()
          if [ -n "${{ github.event.inputs.today }}" ]; then
-            flags="$flags --today ${{ github.event.inputs.today }}"
+            flags+=(--today "${{ github.event.inputs.today }}")
          fi
          if [ "${{ github.event.inputs.skip_inspect }}" = "true" ]; then
-            flags="$flags --no-inspect"
+            flags+=(--no-inspect)
          fi
          pnpm --filter @open-design/landing-page exec tsx scripts/blog-indexing/report-3day.ts \
            --summary-out ../../.blog-indexing/blog-traffic-digest-summary.json \
-            $flags
+            "${flags[@]}"
          # Surface the latest section in the run summary for quick review.
          {
            echo "### Latest digest section"
--- a/.github/workflows/blog-indexing-monitor.yml
+++ b/.github/workflows/blog-indexing-monitor.yml
@ -251,7 +251,9 @@ jobs:
        run: |
          existing=$(gh issue list --repo nexu-io/open-design --state open --search 'in:title "Blog indexing — URLs stalled in Search Console"' --json number --jq '.[0].number // empty')
          if [ -n "$existing" ]; then
-            gh issue comment "$existing" --repo nexu-io/open-design --body 'All previously stalled URLs have reached `indexed` status. Closing automatically. — `blog-indexing-monitor`'
+            body_file="$RUNNER_TEMP/blog-indexing-monitor-stall-close.md"
+            printf '%s\n' "All previously stalled URLs have reached \`indexed\` status. Closing automatically. — \`blog-indexing-monitor\`" > "$body_file"
+            gh issue comment "$existing" --repo nexu-io/open-design --body-file "$body_file"
            gh issue close "$existing" --repo nexu-io/open-design
          fi

@ -262,7 +264,9 @@ jobs:
        run: |
          existing=$(gh issue list --repo nexu-io/open-design --state open --search 'in:title "Blog traffic — indexed posts with zero impressions"' --json number --jq '.[0].number // empty')
          if [ -n "$existing" ]; then
-            gh issue comment "$existing" --repo nexu-io/open-design --body 'All previously low-traffic tracked URLs now have impressions or no longer match the escalation window. Closing automatically. — `blog-indexing-monitor`'
+            body_file="$RUNNER_TEMP/blog-indexing-monitor-low-traffic-close.md"
+            printf '%s\n' "All previously low-traffic tracked URLs now have impressions or no longer match the escalation window. Closing automatically. — \`blog-indexing-monitor\`" > "$body_file"
+            gh issue comment "$existing" --repo nexu-io/open-design --body-file "$body_file"
            gh issue close "$existing" --repo nexu-io/open-design
          fi

--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -86,7 +86,7 @@ jobs:
              case "$file" in
                *.md|*.mdx|*.txt|LICENSE|.gitignore|.editorconfig|.vscode/*|.idea/*|docs/*|.github/ISSUE_TEMPLATE/*|.github/CODEOWNERS)
                  ;;
-                apps/landing-page/*|flake.nix|flake.lock|nix/*|.github/workflows/nix-check.yml|.github/workflows/landing-page-ci.yml|.github/workflows/landing-page-deploy.yml|.github/workflows/blog-indexing-on-deploy.yml|.github/workflows/blog-indexing-monitor.yml)
+                apps/landing-page/*|flake.nix|flake.lock|nix/*|.github/workflows/nix-check.yml|.github/workflows/landing-page-ci.yml|.github/workflows/landing-page-deploy.yml|.github/workflows/blog-indexing-on-deploy.yml|.github/workflows/blog-indexing-monitor.yml|.github/workflows/blog-3day-report.yml|.github/workflows/seo-daily-report.yml|.github/workflows/actionlint.yml|.github/workflows/visual-pr-capture.yml|.github/workflows/visual-pr-comment.yml)
                  ;;
                *)
                  workspace_validation_required=true
--- a/.github/workflows/seo-daily-report.yml
+++ b/.github/workflows/seo-daily-report.yml
@ -103,11 +103,11 @@ jobs:
          OPP_LOW_CTR: '0.01'
          OPP_MOBILE_DESKTOP_CTR_GAP: '0.30'
        run: |
-          flags=""
+          flags=()
          if [ -n "${{ github.event.inputs.today }}" ]; then
-            flags="$flags --today ${{ github.event.inputs.today }}"
+            flags+=(--today "${{ github.event.inputs.today }}")
          fi
          if [ "${{ github.event.inputs.dry_run }}" = "true" ]; then
-            flags="$flags --dry-run"
+            flags+=(--dry-run)
          fi
-          pnpm --filter @open-design/landing-page exec tsx scripts/seo-daily-report.ts $flags
+          pnpm --filter @open-design/landing-page exec tsx scripts/seo-daily-report.ts "${flags[@]}"
--- a/.github/workflows/visual-pr-comment.yml
+++ b/.github/workflows/visual-pr-comment.yml
@ -125,12 +125,14 @@ jobs:
            echo "Artifact manifest head_sha ($manifest_head) does not match workflow_run head_sha ($WORKFLOW_HEAD_SHA)." >&2
            exit 1
          fi
-          echo "path=$manifest" >> "$GITHUB_OUTPUT"
-          echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
-          echo "head_sha=$manifest_head" >> "$GITHUB_OUTPUT"
-          echo "base_sha=$base_sha" >> "$GITHUB_OUTPUT"
-          echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
-          echo "capture_outcome=$capture_outcome" >> "$GITHUB_OUTPUT"
+          {
+            echo "path=$manifest"
+            echo "pr_number=$pr_number"
+            echo "head_sha=$manifest_head"
+            echo "base_sha=$base_sha"
+            echo "run_id=$run_id"
+            echo "capture_outcome=$capture_outcome"
+          } >> "$GITHUB_OUTPUT"

      - name: Validate live PR state for trusted checkout
        if: ${{ github.event_name == 'workflow_dispatch' }}
--- a/tools/pack/src/mac/app.ts
+++ b/tools/pack/src/mac/app.ts
@ -1,4 +1,4 @@
-import { mkdir, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { cp, mkdir, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, join, relative } from "node:path";

 import { rebuild, type RebuildOptions } from "@electron/rebuild";