ci: pin actionlint version and add pre-commit hook

.github/workflows/ci.yaml

@@ -61,6 +61,7 @@ jobs:
           persist-credentials: false
       - uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2
         with:
+          version: "1.7.12"
           # Pass explicit file globs so actionlint does not need to discover
           # the project root from GITHUB_WORKSPACE (which doesn't contain
           # .github/workflows/ when checkout used a path: subdirectory).

.pre-commit-config.yaml

@@ -47,3 +47,9 @@ repos:
     hooks:
       - id: markdownlint-cli2
         args: [--fix]
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.12
+    hooks:
+      - id: actionlint
+        entry: bash scripts/pre-commit/actionlint.sh
+        verbose: true

scripts/pre-commit/actionlint.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$(uname -s)" == Darwin ]]; then
+  printf '%s\n' "actionlint: ShellCheck skipped on Darwin due to actionlint's pipe deadlock; CI runs it on Linux." >&2
+  exec actionlint -shellcheck= "$@"
+fi
+
+exec actionlint "$@"