fix(ci): run pinned actionlint without Docker

[cristim]

Workflow commits stall when the local Docker transport is unavailable. Run actionlint 1.7.12 in pre-commit's Python 3.12 environment with ShellCheck 0.11.0 and pyflakes 3.4.0, matching the existing pinned CI image, and fail if a checker or cached module identity is missing or wrong.

The wrapper installs the pinned Go module once inside that environment and verifies its build metadata before execution. The same regression fixtures run against the native hook and pinned Docker image in Linux CI, while zizmor keeps its existing version, arguments and workflow filter.

Verified on macOS with Go 1.26.9 and Python 3.12.14:

• Real workflow, shell and Python error fixtures, spaced paths, config forwarding and .yaml hook selection.
• Cold bootstrap, warm offline execution, concurrent bootstrap, bounded lock contention, missing checker/Go and corrupt, mismatched or symlinked cache failures.
• Actual pre-commit run actionlint --all-files --verbose passed all 15 tracked workflows.
• make build and make test-unit passed, including race detection.

Linux Docker parity and the normal CI gates run on this PR.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 8 billable files and costs up to $2.00.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 11 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 61 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 4300b8b2-d586-40c7-a344-1eb0a14bc871

📥 Commits

Reviewing files that changed from the base of the PR and between 842ec35 and f419e1b.

📒 Files selected for processing: 8

• .github/workflows/pre-commit.yml
• .pre-commit-config.yaml
• scripts/actionlint-hook.py
• scripts/test-actionlint-hook.sh
• scripts/testdata/actionlint-hook/clean.fixture
• scripts/testdata/actionlint-hook/python.fixture
• scripts/testdata/actionlint-hook/shell.fixture
• scripts/testdata/actionlint-hook/syntax.fixture

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Local verification for head f419e1b2fea3ccd4d09f050e7bcc1ba61fc60996 and tree 7e248c37aa5e252c5c0cdfacc27c2e6db6103e91:

• Real scenario: the updated pre-commit run actionlint --all-files --verbose passed all 15 tracked workflows on macOS, and ordinary commit hooks passed actionlint, zizmor, secret scanning and Trivy.
• Fixture evidence: real actionlint, ShellCheck and pyflakes exercised malformed YAML, shell and Python findings, .yaml selection, spaced paths, config consumption, cold and warm caches, concurrent bootstrap, missing dependencies and corrupt or symlinked cache rejection.
• The held-lock regression failed on the prior unbounded code by reaching its 2-second alarm, then returned the intended timeout error in 0.19 seconds after correction. This before/after result was captured by the implementer.
• make build and make test-unit passed with Go 1.26.9, including -race -short. The native fixture runner used Python 3.12.14 and pre-commit 4.0.1.

Two independent staged review passes are complete on the committed tree, with the lock acquisition bound corrected in the same changeset. A fresh independent review of the exact commit is running separately, and Linux Docker/native fixture parity remains pending in CI.

The Go check verifies embedded module identity against the pinned version and module checksum. It doesn't claim a signature over executable bytes.

[cristim]

Linux verification passed on f419e1b2fea3ccd4d09f050e7bcc1ba61fc60996 in pre-commit run 38729061732.

The Verify actionlint native transport and pinned image parity step actually ran bash scripts/test-actionlint-hook.sh --docker-parity and completed with actionlint transport regression checks passed. This exercises the same clean, bad-shell, bad-Python and invalid-YAML fixtures through the native hook and the existing immutable Docker image, requiring the corresponding checker diagnostics; the .yaml and spaced filename cases also passed. These are fixture-based parity checks.

The subsequent normal repository pre-commit run also passed actionlint and zizmor. Independent committed-SHA review and the main CI run remain pending.

[cristim]

Independent adversarial verification: no actionable findings in both passes on commit f419e1b2fea3ccd4d09f050e7bcc1ba61fc60996, tree 7e248c37aa5e252c5c0cdfacc27c2e6db6103e91, against base 842ec3519d35b0ec97269b92332eaf6721d4f0d4. Reviewer: fresh gpt-6.1-sol medium, separate from the implementation and earlier source reviewer.

The reviewer inspected all eight changed files, upstream actionlint checker invocation sources, hook filtering and argv forwarding, pinned tool identity, missing-only provisioning, retained lock inode and bounded acquisition, checker failures, corrupt caches and symlinks. Independent macOS probes passed for actual exact-commit workflow sources, warm offline execution, negative shell/Python/YAML fixtures, missing prerequisites, wrong/corrupt binaries, symlinks and held-lock timeout. Scratch mutations proved that removing ShellCheck makes the negative-shell probe detect lost coverage and changing the expected module checksum rejects the cached tool.

The reviewer independently inspected successful Linux parity CI, including its actual --docker-parity invocation and regression completion. Local concurrent cold bootstrap could not be reproduced because the verifier sandbox could not resolve the Go module proxy; both attempts failed closed. Concurrent bootstrap success is covered by the successful committed Linux regression suite. Local Docker parity remains unavailable because the host daemon is unresponsive.

The earlier real macOS normal-hook and build/unit verification and Linux parity evidence cover this same SHA. Module build metadata checks declared source identity, rather than signing executable bytes. Main CI remains pending; this review does not replace that gate.

[cristim]

All verification gates now cover unchanged head f419e1b2fea3ccd4d09f050e7bcc1ba61fc60996:

• Main CI completed successfully, including integration tests and the aggregate CI Success check.
• Pre-commit CI completed successfully, including actual Linux native/Docker parity and normal actionlint/zizmor hooks.
• Fresh independent two-pass review found no actionable issues on this exact commit.
• Local macOS real-hook, build and race/unit evidence covers the same committed tree.

Fresh PR inspection reports CLEAN and MERGEABLE; there are no inline review comments or actionable reviewer findings. Main's repository ruleset requires CI Success and Run pre-commit hooks, both successful. CodeRabbit's automatic review hit its included quota and produced no review; the exact-revision local and independent verification path satisfies the project's optional-CodeRabbit condition. No paid review or quota retry was requested.

Ready for the merge owner's normal merge. Follow-up issues filed: none, confirmed against the exit checklist.

[cristim]

Post-merge verification complete for 3d3a76343846df914b8c275e49b083eab93558a8.

The merged tree is exactly 7e248c37aa5e252c5c0cdfacc27c2e6db6103e91, identical to the reviewed commit. All actual post-merge runs passed: main CI, pre-commit, and frontend sentinel. No automatic deployment run was present for this commit; none was triggered manually.

The clean owned worktree, recorded build output and merged local/remote branch refs were reclaimed after checking for borrowers and preserved work. The plan was archived and verification/provenance histories retained. Follow-up issues filed: none, confirmed against the exit checklist.