chore: lint YAML and GitHub Actions workflows

.config/lint/actionlint.yml

@@ -0,0 +1,6 @@
+# https://github.com/rhysd/actionlint/blob/main/docs/config.md
+paths:
+  .github/workflows/build_and_publish.yml:
+    # The deploy job is kept in-tree and forced off (`if: false`) until the railpack switch.
+    ignore:
+      - 'constant expression "false" in condition'

.commitlintrc.yml → .config/lint/commitlintrc.yml

@@ -5,4 +5,3 @@ rules:
     level: error
   # type-empty:
   #   level: error
-

lefthook.yml → .config/lint/lefthook.yml

@@ -1,5 +1,8 @@
 # https://lefthook.dev/configuration/
 # Full list of hooks: https://git-scm.com/docs/githooks
+# Lefthook does not look in this directory. `lefthook install` reads this file via
+# LEFTHOOK_CONFIG, then writes git hooks that source `rc` before every `lefthook run`.
+rc: .config/lint/lefthookrc
 
 # debug hooks with:
 # LEFTHOOK_VERBOSE=1 lefthook run pre-push --force
@@ -29,7 +32,8 @@ prepare-commit-msg:
 commit-msg:
   commands:
     commitlint:
-      run: commitlint
+      # commitlint-rs only auto-discovers a config in the working directory.
+      run: commitlint --config .config/lint/commitlintrc.yml
       skip:
         # only run this if the tool exists, it's conditionally installed
         # https://keisukeyamashita.github.io/commitlint-rs/
@@ -45,6 +49,8 @@ pre-push:
       run: just py_lint
     js_lint:
       run: just js_lint
+    dev_lint:
+      run: just dev_lint
 
 # post-merge: fires after git merge / git pull
 # post-rewrite: fires after git rebase / git commit --amend

.config/lint/lefthookrc

@@ -0,0 +1,3 @@
+# Sourced by the git hooks created with `lefthook install`.
+root=$(git rev-parse --show-toplevel)
+export LEFTHOOK_CONFIG="$root/.config/lint/lefthook.yml"

.config/lint/yamllint.yml

@@ -0,0 +1,27 @@
+# https://yamllint.readthedocs.io/en/stable/configuration.html
+extends: default
+
+ignore: |
+  web/pnpm-lock.yaml
+  lefthook-local.yml
+  node_modules/
+  .venv/
+  tmp/
+
+rules:
+  # `{ key: value }` is the flow style used in workflows.
+  braces:
+    max-spaces-inside: 1
+  # `#cloud-config` must be the first bytes of cloud-init user data, with no space after `#`.
+  comments:
+    ignore: |
+      infra/azure/cloud-init-data-disk.yaml
+  # Commented-out keys (see `.config/lint/commitlintrc.yml`) do not share an indentation with a live node.
+  comments-indentation: disable
+  # Files do not start with `---`. Cloud-init also requires `#cloud-config` on line 1.
+  document-start: disable
+  # Comments, shell one-liners, and copier templates are routinely past 80 columns.
+  line-length: disable
+  # GitHub Actions uses `on:` as a mapping key.
+  truthy:
+    check-keys: false

.config/mise.dev.toml

@@ -20,6 +20,9 @@ direnv = "latest"
 
 "github:peterldowns/localias" = "latest"
 "github:gitleaks/gitleaks" = "latest"
+# workflow and YAML lint, invoked from `just dev_lint`
+actionlint = "latest"
+yamllint = "latest"
 "jq" = "latest"
 "mprocs" = "latest"
 "fd" = "latest"

.config/mise/locks/mise.dev/yamllint/1.38.0/pyproject.toml

@@ -0,0 +1,5 @@
+[project]
+name = "mise-pypi-tool-environment"
+version = "0.0.0"
+requires-python = ">=3.10"
+dependencies = ["yamllint==1.38.0"]