Add actionlint to CI for GitHub Actions workflow validation

.github/workflows/ci.yml

@@ -15,6 +15,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Setup actionlint
+        uses: raven-actions/actionlint@v2
+
       - name: Setup shfmt
         uses: mfinelli/setup-shfmt@v4
 
@@ -24,6 +27,9 @@ jobs:
       - name: Check shell scripts (shellcheck)
         run: find scripts tests -name '*.sh' -type f -exec shellcheck --severity=warning {} +
 
+      - name: Check GitHub Actions workflows (actionlint)
+        run: actionlint
+
   test:
     runs-on: ubuntu-latest
     steps:

CLAUDE.md

@@ -108,33 +108,36 @@ The project uses strict code analysis:
 - Extensive .editorconfig with C# and ReSharper rules
 - Uses Microsoft.VisualStudio.Threading.Analyzers
 - Shell scripts use shfmt for formatting and shellcheck for static analysis
+- GitHub Actions workflows validated with actionlint
 
-### Shell Script Linting
+### Linting
 
-Scripts in `scripts/` and `tests/deb/` are checked with shfmt (formatting) and
-shellcheck (static analysis).
+Shell scripts and GitHub Actions workflows are checked in CI and can be validated locally.
 
 ```bash
 # Run all linters (recommended)
 make lint
 
-# Auto-fix formatting issues
+# Auto-fix shell script formatting
 make lint-fix
 
-# Individual commands (if not using make)
-shfmt -d -i 2 -ci -bn -sr scripts/ tests/
-shellcheck --severity=warning scripts/*.sh tests/deb/*.sh
+# Individual linters
+make lint-shfmt       # Shell formatting
+make lint-shellcheck  # Shell static analysis
+make lint-actionlint  # GitHub Actions workflows
 ```
 
 Install tools:
 
 - **shfmt**: `brew install shfmt` (macOS) or `go install mvdan.cc/sh/v3/cmd/shfmt@latest`
 - **shellcheck**: `brew install shellcheck` (macOS) or `apt-get install shellcheck` (Debian/Ubuntu)
+- **actionlint**: `brew install actionlint` (macOS) or `go install github.com/rhysd/actionlint/cmd/actionlint@latest`
 
 Configuration:
 
 - shfmt: Flags in Makefile (`-i 2 -ci -bn -sr`)
 - shellcheck: `.shellcheckrc` (bash dialect, stricter optional checks enabled)
+- actionlint: Uses shellcheck for `run:` blocks when available
 
 Shell code in GitHub workflow `run:` blocks should follow the same conventions—use
 `${VAR}` (braced) instead of `$VAR` for consistency with shellcheck's

CONTRIBUTING.md

@@ -88,8 +88,9 @@ This project follows a structured workflow documented in
 - Follow existing code patterns and architecture
 - Include unit tests for new functionality
 - Shell scripts must pass `shfmt` formatting and `shellcheck` analysis
-  - Run `make lint` to check locally
-  - Run `make lint-fix` to auto-fix formatting
+- GitHub Actions workflows must pass `actionlint` validation
+  - Run `make lint` to check all locally
+  - Run `make lint-fix` to auto-fix shell formatting
 - Run `dotnet test` before submitting
 
 ## Labels

Makefile

@@ -1,10 +1,10 @@
 # Makefile for keystone-cli development tasks
 #
 # Usage:
-#   make lint       Check shell script formatting and lint errors
+#   make lint       Run all linters (shell scripts and workflows)
 #   make lint-fix   Auto-fix shell script formatting
 
-.PHONY: help lint lint-fix lint-shfmt lint-shfmt-fix lint-shellcheck
+.PHONY: help lint lint-fix lint-shfmt lint-shfmt-fix lint-shellcheck lint-actionlint
 
 .DEFAULT_GOAL := help
 
@@ -20,7 +20,7 @@ help: ## Show available targets
 	@echo "Targets:"
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "  %-15s %s\n", $$1, $$2}'
 
-lint: lint-shfmt lint-shellcheck ## Run all linters (shfmt + shellcheck)
+lint: lint-shfmt lint-shellcheck lint-actionlint ## Run all linters
 	@echo "All checks passed"
 
 lint-fix: lint-shfmt-fix ## Auto-fix formatting issues (shfmt only)
@@ -37,3 +37,7 @@ lint-shfmt-fix: ## Fix shell script formatting
 lint-shellcheck: ## Run shellcheck on shell scripts
 	@echo "Running shellcheck..."
 	@shellcheck --severity=warning $(SHELL_SCRIPTS)
+
+lint-actionlint: ## Validate GitHub Actions workflows
+	@echo "Checking GitHub Actions workflows (actionlint)..."
+	@actionlint