fix(ci): lint workflow changes with actionlint (#2742)

* fix(ci): lint workflow changes with actionlint

* fix(ci): lint workflow changes with actionlint

Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode)

* fix(ci): lint workflow changes with actionlint

Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode)

* fix(ci): lint workflow changes with actionlint

Generated-By: looper 0.0.0-dev (runner=fixer, agent=opencode)

.github/workflows/actionlint.yml

@@ -0,0 +1,28 @@
+name: actionlint
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/**
+  push:
+    branches:
+      - main
+    paths:
+      - .github/workflows/**
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    name: Lint GitHub Actions workflows
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+
+      - name: Check workflow files
+        uses: docker://rhysd/actionlint:1.7.12
+        with:
+          args: -color

.github/workflows/blog-3day-report.yml

@@ -87,9 +87,11 @@ jobs:
           if [ -n "$FEISHU_BLOG_DIGEST_WEBHOOK" ]; then
             feishu=true
           fi
-          echo "gsc=$gsc" >> "$GITHUB_OUTPUT"
+          {
-          echo "bot=$bot" >> "$GITHUB_OUTPUT"
+            echo "gsc=$gsc"
-          echo "feishu=$feishu" >> "$GITHUB_OUTPUT"
+            echo "bot=$bot"
+            echo "feishu=$feishu"
+          } >> "$GITHUB_OUTPUT"
           {
             echo "### Blog 3-day report configuration"
             echo "- GSC auth configured: \`$gsc\`"
@@ -122,16 +124,16 @@ jobs:
           GSC_SERVICE_ACCOUNT_KEY: ${{ secrets.GSC_SERVICE_ACCOUNT_KEY }}
         run: |
           mkdir -p .blog-indexing
-          flags=""
+          flags=()
           if [ -n "${{ github.event.inputs.today }}" ]; then
-            flags="$flags --today ${{ github.event.inputs.today }}"
+            flags+=(--today "${{ github.event.inputs.today }}")
           fi
           if [ "${{ github.event.inputs.skip_inspect }}" = "true" ]; then
-            flags="$flags --no-inspect"
+            flags+=(--no-inspect)
           fi
           pnpm --filter @open-design/landing-page exec tsx scripts/blog-indexing/report-3day.ts \
             --summary-out ../../.blog-indexing/blog-traffic-digest-summary.json \
-            $flags
+            "${flags[@]}"
           # Surface the latest section in the run summary for quick review.
           {
             echo "### Latest digest section"

.github/workflows/blog-indexing-monitor.yml

@@ -251,7 +251,9 @@ jobs:
         run: |
           existing=$(gh issue list --repo nexu-io/open-design --state open --search 'in:title "Blog indexing — URLs stalled in Search Console"' --json number --jq '.[0].number // empty')
           if [ -n "$existing" ]; then
-            gh issue comment "$existing" --repo nexu-io/open-design --body 'All previously stalled URLs have reached `indexed` status. Closing automatically. — `blog-indexing-monitor`'
+            body_file="$RUNNER_TEMP/blog-indexing-monitor-stall-close.md"
+            printf '%s\n' "All previously stalled URLs have reached \`indexed\` status. Closing automatically. — \`blog-indexing-monitor\`" > "$body_file"
+            gh issue comment "$existing" --repo nexu-io/open-design --body-file "$body_file"
             gh issue close "$existing" --repo nexu-io/open-design
           fi
 
@@ -262,7 +264,9 @@ jobs:
         run: |
           existing=$(gh issue list --repo nexu-io/open-design --state open --search 'in:title "Blog traffic — indexed posts with zero impressions"' --json number --jq '.[0].number // empty')
           if [ -n "$existing" ]; then
-            gh issue comment "$existing" --repo nexu-io/open-design --body 'All previously low-traffic tracked URLs now have impressions or no longer match the escalation window. Closing automatically. — `blog-indexing-monitor`'
+            body_file="$RUNNER_TEMP/blog-indexing-monitor-low-traffic-close.md"
+            printf '%s\n' "All previously low-traffic tracked URLs now have impressions or no longer match the escalation window. Closing automatically. — \`blog-indexing-monitor\`" > "$body_file"
+            gh issue comment "$existing" --repo nexu-io/open-design --body-file "$body_file"
             gh issue close "$existing" --repo nexu-io/open-design
           fi
 

.github/workflows/ci.yml

@@ -86,7 +86,7 @@ jobs:
               case "$file" in
                 *.md|*.mdx|*.txt|LICENSE|.gitignore|.editorconfig|.vscode/*|.idea/*|docs/*|.github/ISSUE_TEMPLATE/*|.github/CODEOWNERS)
                   ;;
-                apps/landing-page/*|flake.nix|flake.lock|nix/*|.github/workflows/nix-check.yml|.github/workflows/landing-page-ci.yml|.github/workflows/landing-page-deploy.yml|.github/workflows/blog-indexing-on-deploy.yml|.github/workflows/blog-indexing-monitor.yml)
+                apps/landing-page/*|flake.nix|flake.lock|nix/*|.github/workflows/nix-check.yml|.github/workflows/landing-page-ci.yml|.github/workflows/landing-page-deploy.yml|.github/workflows/blog-indexing-on-deploy.yml|.github/workflows/blog-indexing-monitor.yml|.github/workflows/blog-3day-report.yml|.github/workflows/seo-daily-report.yml|.github/workflows/actionlint.yml|.github/workflows/visual-pr-capture.yml|.github/workflows/visual-pr-comment.yml)
                   ;;
                 *)
                   workspace_validation_required=true

.github/workflows/seo-daily-report.yml

@@ -103,11 +103,11 @@ jobs:
           OPP_LOW_CTR: '0.01'
           OPP_MOBILE_DESKTOP_CTR_GAP: '0.30'
         run: |
-          flags=""
+          flags=()
           if [ -n "${{ github.event.inputs.today }}" ]; then
-            flags="$flags --today ${{ github.event.inputs.today }}"
+            flags+=(--today "${{ github.event.inputs.today }}")
           fi
           if [ "${{ github.event.inputs.dry_run }}" = "true" ]; then
-            flags="$flags --dry-run"
+            flags+=(--dry-run)
           fi
-          pnpm --filter @open-design/landing-page exec tsx scripts/seo-daily-report.ts $flags
+          pnpm --filter @open-design/landing-page exec tsx scripts/seo-daily-report.ts "${flags[@]}"

.github/workflows/visual-pr-comment.yml

@@ -125,12 +125,14 @@ jobs:
             echo "Artifact manifest head_sha ($manifest_head) does not match workflow_run head_sha ($WORKFLOW_HEAD_SHA)." >&2
             exit 1
           fi
-          echo "path=$manifest" >> "$GITHUB_OUTPUT"
+          {
-          echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
+            echo "path=$manifest"
-          echo "head_sha=$manifest_head" >> "$GITHUB_OUTPUT"
+            echo "pr_number=$pr_number"
-          echo "base_sha=$base_sha" >> "$GITHUB_OUTPUT"
+            echo "head_sha=$manifest_head"
-          echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
+            echo "base_sha=$base_sha"
-          echo "capture_outcome=$capture_outcome" >> "$GITHUB_OUTPUT"
+            echo "run_id=$run_id"
+            echo "capture_outcome=$capture_outcome"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Validate live PR state for trusted checkout
         if: ${{ github.event_name == 'workflow_dispatch' }}

tools/pack/src/mac/app.ts

@@ -1,4 +1,4 @@
-import { mkdir, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { cp, mkdir, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, join, relative } from "node:path";
 
 import { rebuild, type RebuildOptions } from "@electron/rebuild";