feat(ci): add YAML and GitHub Actions lint analysis for PRs

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - blacksmith-4vcpu-ubuntu-2404

.github/dependabot.yml

@@ -103,12 +103,23 @@ updates:
           - "minor"
           - "patch"
 
+      # Linting and code quality actions
+      linting:
+        patterns:
+          - "ibiqlik/action-yamllint"
+          - "raven-actions/actionlint"
+          - "crate-ci/typos"
+          - "tcort/github-action-markdown-link-check"
+        update-types:
+          - "major"
+          - "minor"
+          - "patch"
+
       # Miscellaneous third-party utilities
       utilities:
         patterns:
           - "amannn/action-semantic-pull-request"
           - "actions/labeler"
-          - "tcort/github-action-markdown-link-check"
           - "actions/github-script"
           - "mikefarah/yq"
         update-types:

.github/labels.yml

@@ -87,3 +87,7 @@
 - name: notify
   color: "fbca04"
   description: Changes to notification composite actions (src/notify/)
+
+- name: lint
+  color: "7c3aed"
+  description: Changes to linting and code quality checks

.github/markdown-link-check-config.json

@@ -0,0 +1,26 @@
+{
+  "ignorePatterns": [
+    {
+      "pattern": "^https://github\\.com/LerianStudio/github-actions-shared-workflows/actions/runs/"
+    },
+    {
+      "pattern": "^https://github\\.com/LerianStudio/github-actions-shared-workflows/pull/"
+    },
+    {
+      "pattern": "^https://github\\.com/<"
+    }
+  ],
+  "httpHeaders": [
+    {
+      "urls": ["https://github.com"],
+      "headers": {
+        "Accept-Encoding": "br, gzip, deflate"
+      }
+    }
+  ],
+  "timeout": "10s",
+  "retryOn429": true,
+  "retryCount": 3,
+  "fallbackRetryDelay": "5s",
+  "aliveStatusCodes": [200, 206, 301, 302, 307, 308]
+}

.github/workflows/self-pr-validation.yml

@@ -0,0 +1,214 @@
+name: Self — PR Validation
+
+on:
+  pull_request:
+    branches:
+      - develop
+      - main
+    types:
+      - opened
+      - synchronize
+      - reopened
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  checks: read
+
+jobs:
+  # ----------------- PR Validation -----------------
+  validation:
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+      checks: read
+    uses: ./.github/workflows/pr-validation.yml
+    with:
+      check_changelog: false
+      enforce_source_branches: true
+      allowed_source_branches: "develop|hotfix/*"
+      target_branches_for_source_check: "main"
+    secrets: inherit
+
+  # ----------------- Changed Files Detection -----------------
+  changed-files:
+    name: Detect Changed Files
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      yaml_files: ${{ steps.detect.outputs.yaml-files }}
+      workflow_files: ${{ steps.detect.outputs.workflow-files }}
+      action_files: ${{ steps.detect.outputs.action-files }}
+      composite_files: ${{ steps.detect.outputs.composite-files }}
+      markdown_files: ${{ steps.detect.outputs.markdown-files }}
+      all_files: ${{ steps.detect.outputs.all-files }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Detect changed files
+        id: detect
+        uses: ./src/config/changed-workflows
+        with:
+          github-token: ${{ github.token }}
+
+  # ----------------- YAML Lint -----------------
+  yamllint:
+    name: YAML Lint
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    needs: changed-files
+    if: needs.changed-files.outputs.yaml_files != ''
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: YAML Lint
+        uses: ./src/lint/yamllint
+        with:
+          file-or-dir: ${{ needs.changed-files.outputs.yaml_files }}
+
+  # ----------------- Action Lint -----------------
+  actionlint:
+    name: Action Lint
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    needs: changed-files
+    if: needs.changed-files.outputs.workflow_files != ''
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Action Lint
+        uses: ./src/lint/actionlint
+        with:
+          files: ${{ needs.changed-files.outputs.workflow_files }}
+
+  # ----------------- Pinned Actions Check -----------------
+  pinned-actions:
+    name: Pinned Actions Check
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    needs: changed-files
+    if: needs.changed-files.outputs.action_files != ''
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Pinned Actions Check
+        uses: ./src/lint/pinned-actions
+        with:
+          files: ${{ needs.changed-files.outputs.action_files }}
+
+  # ----------------- Markdown Link Check -----------------
+  markdown-link-check:
+    name: Markdown Link Check
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    needs: changed-files
+    if: needs.changed-files.outputs.markdown_files != ''
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Markdown Link Check
+        uses: ./src/lint/markdown-link-check
+        with:
+          file-path: ${{ needs.changed-files.outputs.markdown_files }}
+
+  # ----------------- Spelling Check -----------------
+  typos:
+    name: Spelling Check
+    needs: changed-files
+    if: needs.changed-files.outputs.all_files != ''
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Spelling Check
+        uses: ./src/lint/typos
+        with:
+          files: ${{ needs.changed-files.outputs.all_files }}
+
+  # ----------------- Shell Check -----------------
+  shellcheck:
+    name: Shell Check
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    needs: changed-files
+    if: needs.changed-files.outputs.action_files != ''
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Shell Check
+        uses: ./src/lint/shellcheck
+        with:
+          files: ${{ needs.changed-files.outputs.action_files }}
+
+  # ----------------- README Check -----------------
+  readme-check:
+    name: README Check
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    needs: changed-files
+    if: needs.changed-files.outputs.action_files != ''
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: README Check
+        uses: ./src/lint/readme-check
+        with:
+          files: ${{ needs.changed-files.outputs.action_files }}
+
+  # ----------------- Composite Schema Lint -----------------
+  composite-schema:
+    name: Composite Schema Lint
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    needs: changed-files
+    if: needs.changed-files.outputs.composite_files != ''
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Composite Schema Lint
+        uses: ./src/lint/composite-schema
+        with:
+          files: ${{ needs.changed-files.outputs.composite_files }}
+
+  # ----------------- Lint Report -----------------
+  lint-report:
+    name: Lint Report
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: write
+      issues: write
+      checks: read
+    needs: [changed-files, yamllint, actionlint, pinned-actions, markdown-link-check, typos, shellcheck, readme-check, composite-schema]
+    if: always() && github.event_name == 'pull_request' && needs.changed-files.result == 'success'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Post Lint Report
+        uses: ./src/notify/pr-lint-reporter
+        with:
+          github-token: ${{ secrets.MANAGE_TOKEN || github.token }}
+          yamllint-result: ${{ needs.yamllint.result }}
+          yamllint-files: ${{ needs.changed-files.outputs.yaml_files }}
+          actionlint-result: ${{ needs.actionlint.result }}
+          actionlint-files: ${{ needs.changed-files.outputs.workflow_files }}
+          pinned-actions-result: ${{ needs.pinned-actions.result }}
+          pinned-actions-files: ${{ needs.changed-files.outputs.action_files }}
+          markdown-result: ${{ needs.markdown-link-check.result }}
+          markdown-files: ${{ needs.changed-files.outputs.markdown_files }}
+          typos-result: ${{ needs.typos.result }}
+          typos-files: ${{ needs.changed-files.outputs.all_files }}
+          shellcheck-result: ${{ needs.shellcheck.result }}
+          shellcheck-files: ${{ needs.changed-files.outputs.action_files }}
+          readme-result: ${{ needs.readme-check.result }}
+          readme-files: ${{ needs.changed-files.outputs.action_files }}
+          composite-schema-result: ${{ needs.composite-schema.result }}
+          composite-schema-files: ${{ needs.changed-files.outputs.composite_files }}

.yamllint.yml

@@ -0,0 +1,20 @@
+---
+extends: default
+
+rules:
+  # GitHub Actions uses bare `on:` as top-level key — avoid truthy false positives
+  truthy:
+    allowed-values: ["true", "false"]
+    check-keys: false
+
+  # Workflow files have long run: blocks and action refs
+  line-length:
+    max: 200
+    level: warning
+
+  indentation:
+    spaces: 2
+    indent-sequences: whatever
+
+  # Not enforcing leading `---` — optional in workflow files
+  document-start: disable

src/config/changed-workflows/README.md

@@ -0,0 +1,52 @@
+<table border="0" cellspacing="0" cellpadding="0">
+  <tr>
+    <td><img src="https://github.com/LerianStudio.png" width="72" alt="Lerian" /></td>
+    <td><h1>changed-workflows</h1></td>
+  </tr>
+</table>
+
+Detect changed files in a pull request and categorize them by type for downstream lint jobs.
+
+## Outputs
+
+| Output | Format | Description |
+|--------|--------|-------------|
+| `yaml-files` | Space-separated | All changed `.yml` files |
+| `workflow-files` | Comma-separated | Changed `.github/workflows/*.yml` files |
+| `action-files` | Space-separated | Changed workflow and composite `.yml`/`.yaml` files |
+| `markdown-files` | Comma-separated | Changed `.md` files |
+
+On `workflow_dispatch`, falls back to scanning the full repository.
+
+## Inputs
+
+| Input | Description | Required | Default |
+|-------|-------------|----------|---------|
+| `github-token` | GitHub token for `gh` CLI access | No | `""` |
+
+## Usage as composite step
+
+```yaml
+- name: Checkout
+  uses: actions/checkout@v4
+
+- name: Detect changed files
+  id: changed
+  uses: LerianStudio/github-actions-shared-workflows/src/config/changed-workflows@v1.2.3
+  with:
+    github-token: ${{ github.token }}
+
+- name: YAML Lint
+  if: steps.changed.outputs.yaml-files != ''
+  uses: LerianStudio/github-actions-shared-workflows/src/lint/yamllint@v1.2.3
+  with:
+    file-or-dir: ${{ steps.changed.outputs.yaml-files }}
+```
+
+## Required permissions
+
+```yaml
+permissions:
+  contents: read
+  pull-requests: read
+```