From 89d83d62685f70db664369d49c9bc169a3376666 Mon Sep 17 00:00:00 2001 From: David Nguyen Date: Wed, 15 Jul 2026 06:46:18 +0700 Subject: [PATCH 1/3] fix(ci): remove invalid metadata permission --- .github/workflows/dependabot-auto-merge.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index ca8fe66..35cb6ce 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -15,7 +15,6 @@ permissions: actions: read checks: read statuses: read - metadata: read jobs: dependabot: From 49d256da28d4485fa5888181eecb62e57079e17f Mon Sep 17 00:00:00 2001 From: David Nguyen Date: Wed, 15 Jul 2026 06:46:38 +0700 Subject: [PATCH 2/3] ci: validate workflow files with actionlint --- .github/workflows/ci.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cb268c8..8ecb014 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,6 +22,19 @@ jobs: - name: Checkout code uses: actions/checkout@v7 + - name: Validate GitHub Actions workflows + env: + ACTIONLINT_VERSION: 1.7.12 + ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 + run: | + set -euo pipefail + curl -fsSL \ + "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \ + -o actionlint.tar.gz + echo "${ACTIONLINT_SHA256} actionlint.tar.gz" | sha256sum --check + tar -xzf actionlint.tar.gz actionlint + ./actionlint -color + - name: Enable Corepack run: corepack enable From 34a38bfff9c957ed4e13460e702d1a8496fbc566 Mon Sep 17 00:00:00 2001 From: David Nguyen Date: Wed, 15 Jul 2026 06:49:19 +0700 Subject: [PATCH 3/3] ci: lint workflow schema without shell diagnostics --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8ecb014..5639cb6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,7 +33,7 @@ jobs: -o actionlint.tar.gz echo "${ACTIONLINT_SHA256} actionlint.tar.gz" | sha256sum --check tar -xzf actionlint.tar.gz actionlint - ./actionlint -color + ./actionlint -shellcheck= -pyflakes= -color - name: Enable Corepack run: corepack enable