[aaronlippold]

What

The workflow linter, shellcheck and oapi-codegen move into mise.toml, with checksums in mise.lock, so local runs and CI use the same releases, as #544 did for Go, golangci-lint, gosec and govulncheck. actionlint is replaced by jactionlint at its correctness profile.

Why

Tool	Before (CI)	Before (local)
actionlint	1.7.12, curl + sha256 in ci.yml env	whatever is on PATH (pnpm lint:workflows)
shellcheck	not pinned: the runner image's copy	Homebrew's
oapi-codegen	go install @v2.8.0 from ci.yml env	whatever is on PATH (pnpm run matrix), hint hard-coded in two places

actionlint has had no release, commit or merged pull request since 2026-04-19, and its $/ support (rhysd/actionlint#711) is still open. jactionlint (MIT, v2.5.0 released 2026-11-05) is a fork that reads the same config, runs shellcheck the same way, accepts $/, and its correctness profile covers actionlint's checks.

How

• mise.toml: "aqua:jdx/jactionlint" = "2.5.0", shellcheck = "0.11.0", "go:github.com/oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen" = "2.8.0". mise lock added their entries and changed nothing else. jactionlint and shellcheck have SHA-256 for all seven platforms; jactionlint's are backed by GitHub attestations, while shellcheck publishes no checksums or signatures, so its SHA-256 is the one mise recorded. oapi-codegen goes through go install, verified by the Go checksum database, like govulncheck.
• ci.yml: scan-workflows installs jactionlint and shellcheck through jdx/mise-action (same pin and mise version as check-go) and runs jactionlint; command -v shellcheck still fails the step if shellcheck is missing. check-openapi-matrix installs Go and oapi-codegen through mise-action instead of go install, and no longer asks the shared setup for a second Go. ACTIONLINT_VERSION, ACTIONLINT_SHA256 and OAPI_CODEGEN_VERSION are removed; the oapi-codegen "measurement subject" note moves to mise.toml.
• .github/jactionlint.yaml selects profile: correctness. .github/actionlint.yaml is removed: it held only the ignore patterns for $/, and it said to delete it once a pinned linter accepts $/. jactionlint now checks $/ targets and their inputs.
• setup-npm/action.yml: the one new correctness finding (shellcheck SC1003 on tr '\\' '/') is fixed with ${modules//\\//}, which converts the same Windows path without the pipe.
• hdf-openapi/test/matrix.test.ts parses ci.yml (with the yaml package hdf-openapi already depends on) and checks the check-openapi-matrix job itself: mise-action installs the generator mise.toml pins before the matrix step, no other step mentions oapi-codegen, no if: or continue-on-error on the job or any step up to the matrix, and gate-hdf-scans needs the job, runs if: always() and has a step whose condition is exactly the OR of failure, cancelled and skipped and which exits 1. It requires mise.lock to lock the pinned version, and the pin to equal the baseline's recorded version. It splits mise.toml and mise.lock on CRLF too, for Windows checkouts. On main the test only searched ci.yml for text, and its "CI runs the matrix" substring also matched a comment, so it passed with the step removed.
• pnpm lint:workflows runs jactionlint; the matrix script's hint, hdf-openapi's README, CLAUDE.md and the developer guide point at mise install and running under mise exec -- (or with mise activated), as the developer guide's toolchain section does.

Verification

• TDD: the matrix.test.ts change failed first ("mise.toml must pin the generator version"), then passed after the change.
• The CI-wiring test fails for each of 14 changes applied to a copy of the files and restored: matrix step removed, generator installed outside mise, pin differing from the baseline, matrix step continue-on-error, install step if: false, an extra step fetching the generator, the job dropped from the gate, the install after the matrix, the gate without always(), its rejection step removed, the skipped case dropped, || changed to &&, the step continue-on-error, and exit 1 removed. It passes with mise.toml, mise.lock and ci.yml in CRLF, and fails when mise.lock locks a different version.
• Independent reviews (verdicts read from each reviewer's own log): Gemini gemini-4-argon-high PASS at round 1; Codex gpt-6.1-sol PASS at round 3. Findings fixed on the way: the Windows CRLF failure (confirmed by CI), textual CI checks, the lock not checked, the gate's rejection not checked, comments overstating lock checksums and what mise install puts on PATH; CodeQL's incomplete-escaping alert on built regexes; a mise.lock I had committed at 2.8.2 (mise rewrote it during a local check).
• Local, after mise install: jactionlint 2.5.0, shellcheck 0.11.0 and oapi-codegen v2.8.0 resolve to mise's installs; pnpm --filter @mitre/hdf-openapi run matrix matches the baseline; matrix.test.ts 38/38 with both generators re-measured; zizmor 1.30.0 no findings.
• pnpm check in the pre-commit hook.

Before merge

#546 is merged and this branch is updated from main (merge commit, no rebase), so jactionlint's only finding, the deprecated app-id input in snapshot.yml, is gone: pnpm lint:workflows exits 0 and zizmor reports no findings on the merged tree. The merge was clean; the developer guide's toolchain section and the ci.yml header, which #547 also edited, read consistently.

jactionlint's default profile (security and policy rules) reports more findings on main; the release-workflow ones are fixed in #547 and the rest are tracked separately before that profile is turned on.

[wdower]

Moved the matrix wiring assertions out of hdf-openapi/test/matrix.test.ts into scripts/check-openapi-matrix-wiring.mjs because they read repo infrastructure — ci.yml, mise.toml, mise.lock, the root package.json — rather than any package code, which is what the other scripts/check-* guards do; the real measurement against the installed generator stays in the package, where the baseline lives.