Imported from bedkillerspacex-boop/codex-skill-library (typescript-actionlint-ops/SKILL.md). Install upstream with npx skills add bedkillerspacex-boop/codex-skill-library --skill typescript-actionlint-ops. Copyright stays with the author.

TypeScript Actionlint Ops

Scope And Authorization

• In scope: owned repositories; linting and fixing GitHub Actions workflows you control.
• Out of scope: modifying workflows in orgs without permission; secret exfiltration research beyond authorized hardening.
• Prefer CI non-blocking first if workflows are legacy-noisy, then fail-closed.
• Redact secrets that appear in workflow logs when triaging.
• Pair workflow edits with code-quality-standards and secure CI practices.

When To Use

• Add static checks for .github/workflows/*.yml in a TS monorepo.
• Catch expression errors, invalid runs-on, bad permissions:, and shell issues early.
• Standardize actionlint version across repos.
• Pre-commit or CI job before merge.

Do Not Use As Primary

Domain Focus

Commands

# Install (example — pin version in CI)
# https://github.com/rhysd/actionlint/releases
actionlint -version

# Lint all workflows
actionlint

# Explicit paths
actionlint .github/workflows/*.yml

# With shellcheck on PATH
actionlint -shellcheck shellcheck

# JSON for tooling
actionlint -format '{{json .}}' > actionlint-report.json

# .github/workflows/actionlint.yml sketch
name: actionlint
on: [push, pull_request]
jobs:
  actionlint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install actionlint
        run: |
          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.7.7
      - run: ./actionlint -color

# actionlint.yaml (optional)
self-hosted-runner:
  labels: [self-hosted, linux, x64]
config-variables: null

Workflow

1. Confirm scope

1. Repos and workflow owners; required checks policy.
2. Success: “PRs fail on actionlint errors; critical workflows least-privilege permissions.”

2. Inventory

1. List workflows; note reusable workflows and local actions.
2. Self-hosted runner labels that must be declared for actionlint.
3. Existing super-linter / check-yaml overlap.

3. Baseline

actionlint 2> actionlint-baseline.txt || true

1. Classify true positives vs style noise.

4. Integrate

1. Pin actionlint version in CI download step.
2. Add job to required checks when clean.
3. Fix high-value issues: bad expressions, secrets in echo, missing permissions.
4. Prefer OIDC + least permissions: over long-lived PATs.

5. Verify

actionlint
# TS package workflows still typecheck separately
pnpm tsc --noEmit

6. Observe and hand off

1. Track suppressions; revisit quarterly.
2. Document how to run actionlint locally for workflow authors.
3. Pair with CODEOWNERS on .github/workflows.

Good / Bad

Output Checklist

• actionlint pinned in CI
• Baseline issues dispositioned
• Local run instructions documented
• Self-hosted labels configured if needed
• Shellcheck enabled when applicable
• Workflow permissions reviewed
• CODEOWNERS for workflows
• Required check enabled or exception dated
• code-quality-standards applied

Rules

• Only modify workflows you are authorized to change.
• Linting is necessary but not sufficient for CI security.
• Keep focus on actionlint operations for GHA in TS repos.