From f960c990c36174449892787091fb4f7fc44291ae Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 27 Sep 2026 22:55:48 +0000
Subject: [PATCH] ci: actionlint + concurrency harden (#41)

Add a fail-hard Workflow lint job that installs pinned actionlint v1.7.12
(linux/amd64 tarball, sha256 from the release checksums file) and cancel
in-progress runs on validate and CodeQL. Skip gitleaks.

Co-authored-by: Code Solutions LLC <CodeSolutionsLLC@users.noreply.github.com>
---
 .github/workflows/codeql.yml   |  4 ++++
 .github/workflows/validate.yml | 36 ++++++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index be7a17e..7d5609f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -8,6 +8,10 @@ on:
   schedule:
     - cron: "17 9 * * 1"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
   security-events: write
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index cbb0245..0458ef1 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -74,3 +78,35 @@ jobs:
             exit 1
           fi
           echo "Relative markdown links OK."
+
+  workflow-lint:
+    name: Workflow lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Install actionlint
+        env:
+          # rhysd/actionlint v1.7.12 linux/amd64 release tarball.
+          # SHA256 is the linux_amd64 line in actionlint_1.7.12_checksums.txt
+          # (same digest as the GitHub release asset).
+          ACTIONLINT_VERSION: "1.7.12"
+          ACTIONLINT_SHA256: "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8"
+        run: |
+          set -euo pipefail
+          version="${ACTIONLINT_VERSION}"
+          expected="${ACTIONLINT_SHA256}"
+          tarball="actionlint_${version}_linux_amd64.tar.gz"
+          checksums="actionlint_${version}_checksums.txt"
+          base="https://github.com/rhysd/actionlint/releases/download/v${version}"
+          curl -fsSL -o "${tarball}" "${base}/${tarball}"
+          curl -fsSL -o "${checksums}" "${base}/${checksums}"
+          grep -qxF "${expected}  ${tarball}" "${checksums}"
+          echo "${expected}  ${tarball}" | sha256sum -c -
+          tar -xzf "${tarball}" actionlint
+          ./actionlint -version
+
+      - name: Lint workflows
+        run: ./actionlint -color .github/workflows/*.yml