[onedr0p]

Pins actionlint alongside the existing zizmor pin so the shared actionlint pre-commit hook from home-operations/.github#49 can run here, and refreshes the lockfile.

[greptile-apps]

Greptile Summary

Pins actionlint 1.7.12 in the mise tool configuration and refreshes the generated lockfile with its platform artifacts plus updated metadata for existing tools.

Confidence Score: 5/5

The change appears safe to merge with no actionable defects identified.

The actionlint pin and generated lock entries follow the repository’s existing mise and Aqua conventions, and the refreshed metadata does not introduce a concrete incompatible installation path.

T-Rex Logs

What T-Rex did

• T-Rex produced a proof for a posted P1 finding.
• Contract validation compared pre-change and post-change states and documented that there was no actionlint pin or locked Linux x64 artifact metadata before; after the change the artifact installs and runs but lint checks fail due to the workflow syntax not being supported by the pinned actionlint release, explaining exit codes.
• Artifacts were captured to support the validation, including one shellscript artifact and three log artifacts.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.mise/config.toml	Adds the actionlint 1.7.12 tool pin needed by the shared pre-commit configuration.
.mise/mise.lock	Locks actionlint artifacts and checksums across supported platforms while refreshing generated URL and provenance metadata.

Comments Outside Diff (1)

1. General comment

   Pinned actionlint rejects the repository's valid parallel-step workflow syntax

   • Bug
     • The newly pinned actionlint 1.7.12 reports two syntax errors in .github/workflows/ci.yaml: background: true at line 115 and - wait: kind at line 141. GitHub introduced these keywords for parallel steps in June 2026, but actionlint 1.7.12 was released in March 2026 and does not recognize them. Consequently, the shared actionlint pre-commit hook this change enables will fail on the repository's committed workflow set.
   • Cause
     • .mise/config.toml pins actionlint 1.7.12, whose workflow parser predates GitHub Actions' background and wait syntax.
   • Fix
     • Use an actionlint release or revision that supports GitHub Actions parallel-step syntax. If none is released yet, defer enabling the shared hook or configure a narrowly scoped temporary exclusion for these known unsupported constructs until upstream support is available.

   _{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "build(mise): add actionlint and refresh ..." | Re-trigger Greptile}