Repository navigation

feat(tsa): switch the time-stamp authority on from machine config #321

	name: Actionlint
	# Validate the GitHub Actions workflow files. The other PR checks don't verify
	# that a workflow is actually runnable, so a malformed one (e.g. an invalid job
	# id) can merge green and only fail at startup on main. actionlint catches that
	# class at PR time. shellcheck integration is disabled (-shellcheck=) to keep
	# the gate focused on workflow validity; drop that flag to also lint run: shell.
	on:
	pull_request:
	branches: [main]
	types: [opened, synchronize, reopened, ready_for_review]
	push:
	branches: [main]
	paths: ['.github/workflows/**']
	# One run per PR per workflow: a new push cancels the older PR run. Pushes to
	# main are never cancelled, so every main commit keeps a result.
	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}
	permissions:
	contents: read
	jobs:
	actionlint:
	name: 🧹 Actionlint
	if: github.event.pull_request.draft != true
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- name: 📥 Checkout
	uses: actions/checkout@v4
	- name: 🐹 Setup Go
	uses: actions/setup-go@v5
	with:
	go-version: "stable"
	- name: 🧹 Run actionlint
	run: \|
	go install github.com/rhysd/actionlint/cmd/actionlint@latest
	"$(go env GOPATH)/bin/actionlint" -color -shellcheck=