diff --git a/.devcontainer/post_create_command.sh b/.devcontainer/post_create_command.sh
index e2f4a77..cb4e8f6 100755
--- a/.devcontainer/post_create_command.sh
+++ b/.devcontainer/post_create_command.sh
@@ -18,7 +18,7 @@ npm install -g @devcontainers/cli
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 REPOSITORY_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd -P)"
 
-sudo "${REPOSITORY_ROOT}/tools/tool_installer.py" install bazelisk shellcheck yamlfmt ruff buildifier
+sudo "${REPOSITORY_ROOT}/tools/tool_installer.py" install actionlint bazelisk buildifier ruff shellcheck yamlfmt
 
 pre-commit install
 
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..4fbdf33
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,15 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+self-hosted-runner:
+  labels:
+    - ubuntu-slim
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 9d9776a..a378415 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -11,10 +11,10 @@
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
 name: Validate DevContainer
-description: This workflow is checking that updates do not break stuff. If on main branch, publish to "latest" tag.
+# This workflow is checking that updates do not break stuff. If on main branch, publish to "latest" tag.
 on:
   pull_request:
-    -types: [opened, synchronize, reopened, labeled]
+    types: [opened, synchronize, reopened, labeled]
   push:
     branches:
       - main
diff --git a/.github/workflows/pr-title-semantic.yaml b/.github/workflows/pr-title-semantic.yaml
index 51f999f..de0d3fc 100644
--- a/.github/workflows/pr-title-semantic.yaml
+++ b/.github/workflows/pr-title-semantic.yaml
@@ -11,7 +11,7 @@
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
 name: Validate PR Title
-description: This workflow validates pull request titles against semantic conventions.
+# This workflow validates pull request titles against semantic conventions.
 on:
   pull_request_target:
     types:
diff --git a/.github/workflows/release-and-publish.yaml b/.github/workflows/release-and-publish.yaml
index e8bf17b..a645bc7 100644
--- a/.github/workflows/release-and-publish.yaml
+++ b/.github/workflows/release-and-publish.yaml
@@ -11,7 +11,7 @@
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
 name: DevContainer Release & Validate & Publish
-description: This workflow creates a semantic version release when main changed since the last release tag. Then it checks that for releases, updates do not break stuff and publishes the released container.
+# This workflow creates a semantic version release when main changed since the last release tag. Then it checks that for releases, updates do not break stuff and publishes the released container.
 on:
   schedule:
     - cron: '0 0 * * 1'
@@ -37,7 +37,7 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
       # this should have been done by the checkout action, but it doesn't work in a container, see https://github.com/actions/checkout/issues/766
-      - run: git config --global --add safe.directory $PWD
+      - run: git config --global --add safe.directory "$PWD"
       # pinned version updated automatically by Dependabot.
       # details at https://semantic-release.gitbook.io/semantic-release/usage/installation#global-installation
       - name: npx semantic-release
@@ -47,7 +47,7 @@ jobs:
           npx semantic-release@25.0.1 >> /tmp/semantic-release.log 2>&1 || (cat /tmp/semantic-release.log && exit 1)
           cat /tmp/semantic-release.log
           tag_name=$(grep "Created tag" /tmp/semantic-release.log | sed -E 's/.*Created tag (.*)/\1/')
-          echo "tag_name=$tag_name" >> $GITHUB_OUTPUT
+          echo "tag_name=$tag_name" >> "$GITHUB_OUTPUT"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build:
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ad3a4c6..e4ed0a8 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -35,6 +35,7 @@ repos:
         entry: bazelisk mod deps --lockfile_mode=error
         language: system
         pass_filenames: false
+      # Formatters
       - id: yamlfmt
         name: yamlfmt
         entry: tools/run_tool.sh yamlfmt
@@ -50,6 +51,12 @@ repos:
         entry: tools/run_tool.sh buildifier
         language: system
         types: [bazel]
+      # Static Code Analysis Tools
+      - id: actionlint
+        name: actionlint
+        entry: tools/run_tool.sh actionlint
+        language: system
+        files: ^\.github/workflows/.*\.(yml|yaml)$
       - id: shellcheck
         name: shellcheck
         entry: tools/run_tool.sh shellcheck