Switch actionlint to the kjanat fork, v1.17.0

[roryabraham]

Details

Switches the actionlint we run on every PR in the org from rhysd/actionlint v1.7.11 to the maintained fork, kjanat/actionlint v1.17.0. Upstream has stalled (latest release v1.7.12, ~190 open issues) and its schema predates keys GitHub has since added, so valid workflows fail our check. Tracked in https://github.com/Expensify/Expensify/issues/678960, which also has the audit of the fork.

Three changes:

• scripts/actionlint.sh downloads from kjanat/actionlint releases. The asset naming (actionlint_<version>_<os>_<arch>.tar.gz) is unchanged, so the checksums-file parsing is untouched. The fork prints its version as actionlint.kjanat.dev 1.17.0 rather than the bare version upstream prints, so the cached-binary check now matches on the version number instead of the whole first line.
• scripts/actionlint_checksums.txt replaced with the v1.17.0 checksums. I dropped the .sbom.json lines the fork appends to its checksums file, since the script greps that file for the tarball name and would otherwise match them too.
• Removed the concurrency.queue suppression from .github/actionlint.yml. The fork accepts the key, and nothing in the org uses it yet.

Merge order

This must merge before the 13 follow-up PRs, and it will turn the actionlint check red on them until they merge. The fork adds a cache-call-unrestricted check that flags a reusable workflow call from a pull_request_target, issue_comment, or issues trigger with no cache-mode. Those PRs set cache-mode: read on the affected calls, but that key is not in v1.7.11's schema, so they cannot merge first. Merge this, then merge the follow-ups immediately:

• [No QA] Set cache-mode: read on reusable workflow calls from low-trust triggers App#101846
• Set cache-mode: read on reusable workflow calls from low-trust triggers expensify-common#947
• Set cache-mode: read on reusable workflow calls from low-trust triggers eslint-config-expensify#198
• Set cache-mode: read on reusable workflow calls from low-trust triggers react-native-onyx#849
• Set cache-mode: read on reusable workflow calls from low-trust triggers react-native-qrcode-svg#261
• Set cache-mode: read on reusable workflow calls from low-trust triggers react-native-key-command#54
• Set cache-mode: read on reusable workflow calls from low-trust triggers react-native-x-maps#42
• Set cache-mode: read on reusable workflow calls from low-trust triggers react-fast-pdf#58
• https://github.com/Expensify/react-native-template-repository/pull/65
• Set cache-mode: read on reusable workflow calls from low-trust triggers react-native-x-draggable-list#16
• Set cache-mode: read on reusable workflow calls from low-trust triggers react-native-x-geolocation#21
• Set cache-mode: read on reusable workflow calls from low-trust triggers react-native-live-markdown#779
• Set cache-mode: read on reusable workflow calls from low-trust triggers react-native-wallet#92

I ran the fork against all 152 non-archived repos in the org. 46 of the 74 with workflows pass clean. The 13 above are the only actively maintained repos the new check fails, and each fails only on these reusable workflow calls. The rest are upstream forks we do not actively maintain (retired actions/* versions and the node20 runtime deprecation), which this leaves as is.

Related Issues

https://github.com/Expensify/Expensify/issues/678960

Manual Tests

Ran the modified scripts/actionlint.sh end to end: it downloads the v1.17.0 darwin/arm64 tarball, the checksum matches, it reports actionlint.kjanat.dev 1.17.0, and a second run finds the cached binary instead of re-downloading. Ran the installed binary against this repo's workflows with the updated config; they pass.