build(security): add actionlint pre-commit hook for workflow files (#88) #91

Merged

james merged 1 commit from 88-actionlint-prehook into main 2026-06-18 01:29:45 +00:00

Conversation 0 Commits 1 Files changed 2 +40 -3

james commented 2026-06-18 01:08:29 +00:00

Owner

Copy link

Closes #88. Sister to #89 (CI-side enforcement, still open).

What this does

Adds an actionlint entry to lefthook.yml's pre-commit: block, mirroring the shape of the existing gitleaks hook:

actionlint:
  glob: ".forgejo/workflows/*.yml"
  run: |
    if ! command -v actionlint > /dev/null 2>&1; then
      echo "✗ actionlint not installed."
      …
      exit 1
    fi
    actionlint {staged_files}

• glob scopes the hook to workflow files only — commits that don't touch .forgejo/workflows/ skip this hook entirely (gitleaks still runs).
• {staged_files} template limits the lint to just the matching staged files; editing one workflow doesn't re-lint the others.
• Fails closed if actionlint isn't on PATH, with a brew install actionlint pointer and a reference to README "Requirements".

README updated alongside:

• New bullet under Requirements for actionlint, same shape as gitleaks.
• Setup section now lists both hooks and the LEFTHOOK_EXCLUDE=actionlint skip pattern.

Test plan

Verified locally with two scenarios:

Scenario	Expected	Actual
git add README.md lefthook.yml then lefthook run pre-commit	gitleaks runs, actionlint skipped (no workflows staged)	✓ matches
git add .forgejo/workflows/broken.yml (with ${{ github.no_such_context }}) then lefthook run pre-commit	actionlint fails with line + column citing the undefined context	✓ fails with property "no_such_context" is not defined in object type {action: string; ...}

lefthook validate reports the config is well-formed.

Coordination with #89

This PR enforces actionlint locally. Contributors without actionlint installed, or using git commit --no-verify, can still push workflow regressions; #89 closes that gap by adding the same check to PR CI. Local hook first because it gives fast feedback without burning CI time; CI second to enforce the contract.

Note: untracked private key in the repo root

Heads up — forgejo-signing-key (private) and forgejo-signing-key.pub are sitting in the project root from the merge-commit-signing setup earlier. Not staged here, but worth shred -u forgejo-signing-key && rm forgejo-signing-key.pub once they're copied to the Forgejo host. Untracked private keys at a repo root are one accidental git add . away from leaking.

Closes #88. Sister to #89 (CI-side enforcement, still open). ## What this does Adds an `actionlint` entry to `lefthook.yml`'s `pre-commit:` block, mirroring the shape of the existing `gitleaks` hook: ```yaml actionlint: glob: ".forgejo/workflows/*.yml" run: | if ! command -v actionlint > /dev/null 2>&1; then echo "✗ actionlint not installed." … exit 1 fi actionlint {staged_files} ``` - `glob` scopes the hook to workflow files only — commits that don't touch `.forgejo/workflows/` skip this hook entirely (gitleaks still runs). - `{staged_files}` template limits the lint to just the matching staged files; editing one workflow doesn't re-lint the others. - Fails closed if `actionlint` isn't on `PATH`, with a `brew install actionlint` pointer and a reference to README "Requirements". README updated alongside: - New bullet under **Requirements** for actionlint, same shape as gitleaks. - **Setup** section now lists both hooks and the `LEFTHOOK_EXCLUDE=actionlint` skip pattern. ## Test plan Verified locally with two scenarios: | Scenario | Expected | Actual | |---|---|---| | `git add README.md lefthook.yml` then `lefthook run pre-commit` | gitleaks runs, actionlint skipped (no workflows staged) | ✓ matches | | `git add .forgejo/workflows/broken.yml` (with `${{ github.no_such_context }}`) then `lefthook run pre-commit` | actionlint fails with line + column citing the undefined context | ✓ fails with `property "no_such_context" is not defined in object type {action: string; ...}` | `lefthook validate` reports the config is well-formed. ## Coordination with #89 This PR enforces actionlint locally. Contributors without `actionlint` installed, or using `git commit --no-verify`, can still push workflow regressions; #89 closes that gap by adding the same check to PR CI. Local hook first because it gives fast feedback without burning CI time; CI second to enforce the contract. ## Note: untracked private key in the repo root Heads up — `forgejo-signing-key` (private) and `forgejo-signing-key.pub` are sitting in the project root from the merge-commit-signing setup earlier. Not staged here, but worth `shred -u forgejo-signing-key && rm forgejo-signing-key.pub` once they're copied to the Forgejo host. Untracked private keys at a repo root are one accidental `git add .` away from leaking.

james added 1 commit 2026-06-18 01:08:29 +00:00

build(security): add actionlint pre-commit hook for workflow files (#88) ... cd08810f53

Mirrors the gitleaks hook's shape:
  - `glob: .forgejo/workflows/*.yml` scopes the hook so it only runs
    when workflow files are staged.
  - `{staged_files}` template limits the lint to just those files.
  - Fails closed if `actionlint` isn't on PATH, with a brew-install
    pointer.

Tested locally: a deliberately broken workflow with `${{ github.no_such_context }}`
fails the hook with a precise schema error citing line + column. A
commit that doesn't touch any workflow file skips the hook entirely
(gitleaks still runs).

README "Requirements" picks up the new dependency alongside gitleaks;
Setup explains both hooks and the `LEFTHOOK_EXCLUDE=actionlint` skip
shape for the rare one-off bypass.

Closes #88. CI-side enforcement tracked separately as #89.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

james merged commit 2b8fed41e2 into main 2026-06-18 01:29:45 +00:00

james referenced this pull request from a commit 2026-06-18 01:29:46 +00:00

Merge pull request 'build(security): add actionlint pre-commit hook for workflow files (#88)' (#91) from 88-actionlint-prehook into main

james referenced this pull request 2026-06-18 02:14:16 +00:00

ci(security): post scanner findings as sticky PR comments (#68) #95

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area:auth

Authentication and authorization

  

area:ci

Forgejo Actions, build, test, security, release

  

area:db

Database abstraction, migrations, persistence

  

area:infra

Containerization, deployment, foundational tooling

  

area:native

React Native app (Android + Linux Flatpak)

  

area:pwa

PWA / web frontend

  

area:service

Backend service, API routes, persistence

  

epic

High-level tracker; links several feature tickets

  

feature

A user-facing feature

  

foundation

Foundational work that other tickets build on

No labels

area:auth

area:ci

area:db

area:infra

area:native

area:pwa

area:service

epic

feature

foundation

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

james/carol!91

No description provided.