From 7d7a381e535e8d33d4814ffbd2a8c747d581e272 Mon Sep 17 00:00:00 2001
From: Chris Green <greenc@fnal.gov>
Date: Thu, 29 Oct 2026 11:18:26 -0500
Subject: [PATCH] ci: Add actionlint pre-commit hook

Pin actionlint to v1.7.12 in CI and pre-commit. Skip ShellCheck on Darwin to avoid actionlint's pipe deadlock; CI runs it on Linux.
---
 .github/workflows/ci.yaml        | 1 +
 .pre-commit-config.yaml          | 6 ++++++
 scripts/pre-commit/actionlint.sh | 9 +++++++++
 3 files changed, 16 insertions(+)
 create mode 100644 scripts/pre-commit/actionlint.sh

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 35a16a8..e0a1625 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -61,6 +61,7 @@ jobs:
           persist-credentials: false
       - uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2
         with:
+          version: "1.7.12"
           # Pass explicit file globs so actionlint does not need to discover
           # the project root from GITHUB_WORKSPACE (which doesn't contain
           # .github/workflows/ when checkout used a path: subdirectory).
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 530d01e..a2e79b8 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -47,3 +47,9 @@ repos:
     hooks:
       - id: markdownlint-cli2
         args: [--fix]
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.12
+    hooks:
+      - id: actionlint
+        entry: bash scripts/pre-commit/actionlint.sh
+        verbose: true
diff --git a/scripts/pre-commit/actionlint.sh b/scripts/pre-commit/actionlint.sh
new file mode 100644
index 0000000..14c7260
--- /dev/null
+++ b/scripts/pre-commit/actionlint.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$(uname -s)" == Darwin ]]; then
+  printf '%s\n' "actionlint: ShellCheck skipped on Darwin due to actionlint's pipe deadlock; CI runs it on Linux." >&2
+  exec actionlint -shellcheck= "$@"
+fi
+
+exec actionlint "$@"