Repository navigation
ci: run actionlint from mise, not a Docker action - #288
Conversation
The Docker container action made the workflow fail with startup_failure before any job ran, because container actions cannot start in this org's repos. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![arcjet-review[bot]](https://avatars.githubusercontent.com/u/24397786?s=60&v=4){kind=small}
There was a problem hiding this comment.
Arcjet Review — 🟢 Normal Risk
Decision: Approved
Rationale: This is a narrowly scoped CI installation change with no concrete correctness or security issue found. It preserves actionlint 1.7.12 and its arguments, retains read-only permissions and disabled checkout credentials, and pins the new action by commit SHA. Pinning the mise executable would further improve reproducibility.
Summary of Changes
Replaces the Docker-based actionlint invocation with installation through mise followed by a direct shell invocation. The zizmor check remains unchanged.
Escalation Triggers
- CI/CD Pipeline: Changes tool installation and execution in .github/workflows/lint-workflows.yml.
- Dependency Changes: Introduces jdx/mise-action and mise as CI tooling dependencies.
Review Steps
API Review
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
Data Flow Map
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
Dependency Audit
| Relevancy | Outcome |
|---|---|
| medium |
Using an established installer is reasonable; explicitly pinning mise would improve reproducibility.
Docs Review
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
Historical ADR Review
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
Migration Safety
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
Security Review
| Relevancy | Outcome |
|---|---|
| medium | ✅ Pass |
No new secret exposure, unsafe input interpolation, or permission expansion identified.
Test Coverage
| Relevancy | Outcome |
|---|---|
| medium | ✅ Pass |
The existing workflow exercises installation and actionlint execution on workflow-changing PRs; no additional unit tests are needed.
Zero Data Retention
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
WorkOS Audit Logging
| Relevancy | Outcome |
|---|---|
| none | ⏭️ Skipped |
Notes
Static review only; workflow execution results were not available, so restoration of the previously failing check was not independently verified.
Review: e63d7fab | Model: openai/gpt-6-astra | Powered by Arcjet Review
lint-workflowshas been failing for a while. Attempt to resolve