chore: lint YAML and GitHub Actions workflows

.config/lint/actionlint.yml

@@ -0,0 +1,6 @@
+# https://github.com/rhysd/actionlint/blob/main/docs/config.md
+paths:
+  .github/workflows/build_and_publish.yml:
+    # The deploy job is kept in-tree and forced off (`if: false`) until the railpack switch.
+    ignore:
+      - 'constant expression "false" in condition'

lefthook.yml → .config/lint/lefthook.yml

@@ -1,5 +1,6 @@
 # https://lefthook.dev/configuration/
 # Full list of hooks: https://git-scm.com/docs/githooks
+# Lefthook does not look in this directory. env/dev.sh sets LEFTHOOK_CONFIG.
 
 # debug hooks with:
 # LEFTHOOK_VERBOSE=1 lefthook run pre-push --force
@@ -34,6 +35,8 @@ pre-push:
       run: just py_lint
     js_lint:
       run: just js_lint
+    dev_lint:
+      run: just dev_lint
 
 # post-merge: fires after git merge / git pull
 # post-rewrite: fires after git rebase / git commit --amend

.config/lint/yamllint.yml

@@ -0,0 +1,27 @@
+# https://yamllint.readthedocs.io/en/stable/configuration.html
+extends: default
+
+ignore: |
+  web/pnpm-lock.yaml
+  lefthook-local.yml
+  node_modules/
+  .venv/
+  tmp/
+
+rules:
+  # `{ key: value }` is the flow style used in workflows.
+  braces:
+    max-spaces-inside: 1
+  # `#cloud-config` must be the first bytes of cloud-init user data, with no space after `#`.
+  comments:
+    ignore: |
+      infra/azure/cloud-init-data-disk.yaml
+  # Commented-out keys do not share an indentation with a live node.
+  comments-indentation: disable
+  # Files do not start with `---`. Cloud-init also requires `#cloud-config` on line 1.
+  document-start: disable
+  # Comments, shell one-liners, and copier templates are routinely past 80 columns.
+  line-length: disable
+  # GitHub Actions uses `on:` as a mapping key.
+  truthy:
+    check-keys: false

.config/mise.dev.toml

@@ -20,6 +20,9 @@ direnv = "latest"
 
 "github:peterldowns/localias" = "latest"
 "github:gitleaks/gitleaks" = "latest"
+# workflow and YAML lint, invoked from `just dev_lint`
+actionlint = "latest"
+yamllint = "latest"
 "jq" = "latest"
 "mprocs" = "latest"
 "fd" = "latest"

.config/mise/locks/mise.dev/yamllint/1.38.0/pyproject.toml

@@ -0,0 +1,5 @@
+[project]
+name = "mise-pypi-tool-environment"
+version = "0.0.0"
+requires-python = ">=3.10"
+dependencies = ["yamllint==1.38.0"]