feat(ci): add actionlint workflow validation job

[iap]

Adds a lint-workflows CI job that validates .github/workflows with actionlint v1.7.12.

Details:

• Downloads the pinned actionlint release (v1.7.12) and verifies its sha256 checksum against the official release checksums before use.
• Runs actionlint over .github/workflows (it also invokes shellcheck, preinstalled on ubuntu-latest).
• No new actions added; reuses the already-pinned checkout action SHA.

Verified locally: actionlint v1.7.12 passes on the updated ci.yml (exit 0).

Greptile Summary

Adds a CI job that downloads a checksum-verified actionlint v1.7.12 binary and checks the repository’s GitHub Actions workflows.

The prior workflow-discovery concern was disproved: running actionlint v1.7.12 without positional paths from a repository root detected and rejected a deliberately invalid workflow under .github/workflows.

Confidence Score: 5/5

No blocking failure remains.

No accepted blocking findings remain. An executable check confirmed that the command in .github/workflows/ci.yml discovers workflows under .github/workflows when run from the repository root.

T-Rex Logs

What T-Rex did

• Ran cached actionlint v1.7.12 from a temporary Git repository containing a deliberately invalid .github/workflows/deliberately-invalid.yml, first with no arguments and then with the workflow path supplied; both runs reported the same invalid workflow key and exited with status 1, confirming that actionlint discovers and checks workflows in .github/workflows when run from the repository root.
• Verified the current-code behavior: actionlint discovers and lints workflows in .github/workflows when invoked from the repository root and does not skip that directory.

_{Ran code and verified through T-Rex}

_{Reviews (3): Last reviewed commit: "feat(ci): add actionlint workflow valida..." | Re-trigger Greptile}

[greptile-apps]

Workflow linter receives no workflow paths

actionlint v1.7.12 does not discover files under .github/workflows when it is invoked without positional paths. As a result, ./actionlint exits successfully without checking any workflow, including when a workflow is invalid. Pass every workflow file explicitly, covering both .yml and .yaml extensions where applicable.

Artifacts

Executed actionlint no-argument reproduction script

• The repo-local script recreates the pinned download/checksum/extraction flow and compares no-argument behavior with explicit workflow paths; the takeaway is that it deterministically tests the CI command's silent-skip condition.

Executed actionlint no-argument reproduction output

• Captured output records checksum success and `noarg_with_invalid_workflow=0 explicit_invalid_workflow=1 noarg_pr_ci=0 explicit_pr_ci=0`; the takeaway is that `./actionlint` silently skips workflow validation.

_{Ran code and verified through T-Rex}