Skip to content

feat(scripts): add YAML linting with actionlint#234

Merged
WilliamBerryiii merged 4 commits intomainfrom
feat/add-yaml-linting
Jan 22, 2026
Merged

feat(scripts): add YAML linting with actionlint#234
WilliamBerryiii merged 4 commits intomainfrom
feat/add-yaml-linting

Conversation

@WilliamBerryiii
Copy link
Copy Markdown
Member

Description

Add YAML linting for GitHub Actions workflows using actionlint. This implements a PowerShell wrapper script following existing linting patterns, a reusable GitHub Actions workflow, and integration into the PR validation pipeline.

  • Added Invoke-YamlLint.ps1 PowerShell wrapper script with GitHub Actions annotations, changed-files-only mode, and JSON output
  • Added .github/workflows/yaml-lint.yml reusable workflow with SHA-pinned actions
  • Added .github/actionlint.yaml configuration file with repository-specific settings
  • Updated pr-validation.yml to include yaml-lint job in PR validation pipeline
  • Added lint:yaml npm script and integrated into lint:all
  • Updated linting documentation with YAML Lint section

Related Issue(s)

Closes #232

Type of Change

Select all that apply:

Code & Documentation:

  • Bug fix (non-breaking change fixing an issue)
  • New feature (non-breaking change adding functionality)
  • Breaking change (fix or feature causing existing functionality to change)
  • Documentation update

Infrastructure & Configuration:

  • GitHub Actions workflow
  • Linting configuration (markdown, PowerShell, etc.)
  • Security configuration
  • DevContainer configuration
  • Dependency update

AI Artifacts:

  • Reviewed contribution with prompt-builder agent and addressed all feedback
  • Copilot instructions (.github/instructions/*.instructions.md)
  • Copilot prompt (.github/prompts/*.prompt.md)
  • Copilot agent (.github/agents/*.agent.md)

Other:

  • Script/automation (.ps1, .sh, .py)
  • Other (please describe):

Sample Prompts (for AI Artifact Contributions)

Testing

  • Ran npm run lint:ps - All PSScriptAnalyzer checks pass
  • Ran npm run lint:yaml - All workflow files pass actionlint validation
  • Verified existing Pester tests pass

Checklist

Required Checks

  • Documentation is updated (if applicable)
  • Files follow existing naming conventions
  • Changes are backwards compatible (if applicable)

AI Artifact Contributions

  • Used /prompt-analyze to review contribution
  • Addressed all feedback from prompt-builder review
  • Verified contribution follows common standards and type-specific requirements

Required Automated Checks

The following validation commands must pass before merging:

  • Markdown linting: npm run lint:md
  • Spell checking: npm run spell-check
  • Frontmatter validation: npm run lint:frontmatter
  • Link validation: npm run lint:md-links
  • PowerShell analysis: npm run lint:ps

Security Considerations

  • This PR does not contain any sensitive or NDA information
  • Any new dependencies have been reviewed for security issues
  • Security-related scripts follow the principle of least privilege

Additional Notes

The actionlint tool must be installed separately. Installation methods include:

  • Windows: winget install actionlint or choco install actionlint or scoop install actionlint
  • macOS: brew install actionlint
  • Linux: go install github.com/rhysd/actionlint/cmd/actionlint@latest

The workflow downloads actionlint automatically in CI using the official installation script.

🔧 Generated by Copilot

- Add Invoke-YamlLint.ps1 PowerShell wrapper script
- Add yaml-lint.yml reusable workflow
- Add actionlint.yaml configuration
- Add lint:yaml npm script
- Integrate into lint:all and pr-validation workflow

Closes #232
🤖 Generated by Copilot
@WilliamBerryiii WilliamBerryiii requested a review from a team as a code owner January 21, 2026 22:22
Copilot AI review requested due to automatic review settings January 21, 2026 22:22
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Jan 21, 2026

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
actions/actions/checkout 8e8c483db84b4bee98b60c0593521ed34d9990e8 🟢 6.6
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 79 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7
Code-Review🟢 10all changesets reviewed
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST🟢 8SAST tool detected but not run on all commits
actions/actions/upload-artifact b7c566a772e6b6bfb58ed0dc250532a479d7789f 🟢 6.4
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 1029 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 9SAST tool detected but not run on all commits
Vulnerabilities🟢 91 existing vulnerabilities detected

Scanned Files

  • .github/workflows/yaml-lint.yml

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds YAML linting for GitHub Actions workflow files using actionlint, following the existing linting script patterns in the repository. The implementation includes a PowerShell wrapper script, a reusable GitHub Actions workflow, configuration file, integration into the PR validation pipeline, and updated documentation.

Changes:

  • Added Invoke-YamlLint.ps1 PowerShell wrapper with GitHub Actions annotations, changed-files mode, and JSON output
  • Added .github/workflows/yaml-lint.yml reusable workflow with actionlint integration
  • Added .github/actionlint.yaml configuration file specifying repository variables
  • Integrated YAML linting into PR validation pipeline and npm scripts
  • Updated linting documentation with YAML Lint section

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
scripts/linting/Invoke-YamlLint.ps1 New PowerShell wrapper script for actionlint with comment-based help, parameter handling, and GitHub Actions integration following existing patterns
.github/workflows/yaml-lint.yml New reusable workflow that downloads actionlint and executes validation with configurable soft-fail and changed-files-only modes
.github/actionlint.yaml Configuration file specifying the RELEASE_APP_ID configuration variable for actionlint validation
.github/workflows/pr-validation.yml Integration of yaml-lint job into PR validation pipeline with appropriate permissions
package.json Added lint:yaml npm script and integrated into lint:all command
scripts/linting/README.md Documentation for YAML linting script, parameters, usage examples, and workflow integration

- Pin actionlint to v1.7.10 with SHA256 verification (supply chain security)
- Add installation verification step after actionlint install
- Fix file extension filter to include both .yml and .yaml
- Reorder README sections to maintain PSScriptAnalyzer content grouping
Copilot AI review requested due to automatic review settings January 22, 2026 18:32
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

@WilliamBerryiii WilliamBerryiii merged commit d9301f9 into main Jan 22, 2026
22 checks passed
@WilliamBerryiii WilliamBerryiii deleted the feat/add-yaml-linting branch January 22, 2026 18:42
WilliamBerryiii pushed a commit that referenced this pull request Jan 28, 2026
🤖 I have created a release *beep* *boop*
---


##
[2.0.0](hve-core-v1.1.0...hve-core-v2.0.0)
(2026-01-28)


### ⚠ BREAKING CHANGES

* **agents:** add Task Reviewer and expand RPI to 4-phase workflow
([#277](#277))

### ✨ Features

* **agents:** add hve-core-installer agent to extension package
([#297](#297))
([c0e48c6](c0e48c6))
* **agents:** add Task Reviewer and expand RPI to 4-phase workflow
([#277](#277))
([ae76cab](ae76cab))
* **build:** add code coverage reporting to Pester workflow
([#230](#230))
([a34822a](a34822a))
* **docs:** add GOVERNANCE.md for OSSF Silver Badge compliance
([#235](#235))
([b0e752c](b0e752c))
* **docs:** add ROADMAP.md for OSSF Silver badge compliance
([#238](#238))
([4a41c16](4a41c16))
* **mcp:** add MCP server configuration guidance and installer
enhancements ([#225](#225))
([0bce418](0bce418))
* **scripts:** add YAML linting with actionlint
([#234](#234))
([d9301f9](d9301f9))
* **security:** add OpenSSF Scorecard workflow and badge
([#271](#271))
([7c6d788](7c6d788))
* **skills:** add video-to-gif conversion skill with FFmpeg two-pass
optimization ([#247](#247))
([8d65c42](8d65c42))
* **tests:** add Pester tests for LintingHelpers and
Validate-MarkdownFrontmatter
([#197](#197),
[#198](#198))
([#205](#205))
([51ae563](51ae563))


### 🐛 Bug Fixes

* **build:** detect table formatting changes via git diff
([#261](#261))
([985eee0](985eee0))
* **build:** disable MD024 lint rule in CHANGELOG for release-please
([#220](#220))
([971df94](971df94))
* **build:** quote shell variables and group redirects in workflow files
([#299](#299))
([3372509](3372509))
* **build:** resolve scorecard badge and workflow security issues
([#301](#301))
([aeaed13](aeaed13))
* **extension:** remove frontmatter from README and exclude from
markdown linting
([#223](#223))
([4272529](4272529))
* **instructions:** quote applyTo glob pattern for YAML compatibility
([#216](#216))
([085199c](085199c))
* **scripts:** add FooterExcludePaths parameter to frontmatter
validation ([#334](#334))
([64db98d](64db98d))
* **scripts:** add GHSA word and logs/ exclusion to cspell config
([#214](#214))
([5c99b3f](5c99b3f))
* **scripts:** correct type assertions in Invoke-YamlLint.Tests.ps1
([#332](#332))
([af7050d](af7050d))
* **scripts:** eliminate false positives in dependency pinning npm
pattern ([#273](#273))
([ccbdfa3](ccbdfa3))
* **security:** add artifact attestation for signed releases
([#257](#257))
([c52d6e2](c52d6e2))
* standardize markdown footers and complete frontmatter
([#217](#217))
([b4e7556](b4e7556))


### 📚 Documentation

* add OpenSSF Best Practices Passing badge to README
([#239](#239))
([91bc529](91bc529))
* **architecture:** add architecture documentation and value proposition
([#252](#252))
([0e4b02f](0e4b02f))
* **contributing:** add testing requirements for OSSF compliance
([#254](#254))
([4db1a18](4db1a18))
* **docs:** add enterprise status badges to README header
([#270](#270))
([ccb68a4](ccb68a4))
* **security:** add security assurance case and threat model for OSSF
Silver ([#259](#259))
([a390e26](a390e26))


### ♻️ Refactoring

* **application:** wrap execution with try blocks, ensure proper …
([#296](#296))
([35c4417](35c4417))
* **scripts:** extract frontmatter validation to testable module
([#293](#293))
([4e8707e](4e8707e))
* **scripts:** extract pure functions for Pester testability
([#221](#221))
([d40e742](d40e742))


### 🔧 Maintenance

* **deps-dev:** bump cspell from 9.4.0 to 9.6.0 in the npm-dependencies
group ([#208](#208))
([855914b](855914b))
* **deps-dev:** bump cspell from 9.6.0 to 9.6.1 in the npm-dependencies
group ([#294](#294))
([1e45ad6](1e45ad6))
* **deps:** bump actions/setup-node from 6.1.0 to 6.2.0 in the
github-actions group
([#209](#209))
([c4c69e2](c4c69e2))
* **deps:** bump the github-actions group with 4 updates
([#295](#295))
([d8337b8](d8337b8))
* remove step-security/harden-runner from workflows
([#246](#246))
([c5708d8](c5708d8))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: hve-core-release-please[bot] <254602402+hve-core-release-please[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Issue]: Add YAML linting to validation workflow

3 participants