Add an actionlint CI check for .github/workflows/*.yml #173

What

Add a CI workflow that runs actionlint against every YAML file under .github/workflows/ on pull requests and pushes to the default branch.

Concretely:

• Add a new workflow file (e.g. .github/workflows/actionlint.yml) with a single job that checks out the repo, installs actionlint, and runs it against .github/workflows/*.yml.
• The job must fail the check when actionlint reports any error, so that a typo in run-name, concurrency, permissions, or any other workflow key is caught before merge rather than on the first labelled issue.

Why

PR #169 added .github/workflows/issue-worm.yml with no automated validation of the workflow YAML. A typo in run-name or concurrency would only surface when the issue-worm label is first applied to a real issue — i.e. in production, on the exact path the workflow is meant to serve. actionlint catches schema errors, unknown keys, invalid expression syntax, and many common shell/run: mistakes at PR time.

This was raised as a non-blocking follow-up in the AI review of PR #169 (section 4, "Test coverage").

How

1. Create .github/workflows/actionlint.yml.
2. Trigger on pull_request and push to the default branch, scoped with a paths: filter to .github/workflows/** so it does not run on unrelated changes.
3. Job steps:
   • actions/checkout (pin to a SHA, consistent with the hardening direction in PR Run issue-worm on this repo #169).
   • Install actionlint. Either use the official rhysd/actionlint Docker image, or download the released binary via the documented install script. Prefer a pinned version over latest so the check is reproducible.
   • Run actionlint with no arguments from the repo root — it discovers .github/workflows/*.yml by default. If explicit paths are preferred, pass .github/workflows/*.yml.
4. Set permissions: contents: read on the job. No secrets are required.
5. Add timeout-minutes (e.g. 10) to the job so a hung install does not occupy a runner for the default 6 hours.
6. Optionally add a shellcheck step, since actionlint integrates with it for run: blocks — but keep this out of the initial PR if it expands scope.

Files Affected

• .github/workflows/actionlint.yml (new)
• Unknown (any existing CI workflow file that should be extended instead of adding a new one — confirm before creating a duplicate)

Constraints

• Must not modify .github/workflows/issue-worm.yml — that workflow is out of scope for this issue.
• Must not require any repository secrets. actionlint needs none.
• Must not run on every push to every branch; scope with paths: and branch filters to keep CI cost down.
• Must not be a required status check until it has run green on at least one PR (avoid blocking unrelated work on a new check).
• Pin the actionlint version and any uses: action to a SHA or explicit version tag — do not use latest or a floating major tag.

LLM tier

Haiku — this is a mechanical, single-file addition with a well-known tool and a documented invocation. No design judgment is required beyond choosing a trigger and a version pin.

Success looks like

• A new workflow file exists under .github/workflows/ and runs on PRs that touch .github/workflows/**.
• Introducing a deliberate typo (e.g. an unknown key in issue-worm.yml) on a scratch branch causes the check to fail with a clear actionlint error pointing at the offending line.
• Reverting the typo makes the check pass.
• The check runs in under a minute on a clean checkout.
• No secrets are referenced by the new workflow.

Failure looks like

• The workflow runs on every push to every branch, adding noise and cost.
• The check passes on a workflow file that contains a known-invalid key (i.e. actionlint is not actually being invoked, or its exit code is being swallowed).
• The workflow requires a secret or a token beyond the default GITHUB_TOKEN with contents: read.
• The actionlint version is unpinned, so a future upstream release silently changes what the check enforces.
• The new workflow duplicates an existing CI workflow that already runs lint checks, rather than extending it.

Follow-up from AI review of PR #169.