From ba6d60484dc24ec4eb5a3d60a0fbf9a151ebb71f Mon Sep 17 00:00:00 2001
From: Jesse Alama <hello@jessealama.net>
Date: Thu, 10 Sep 2026 12:19:45 +0200
Subject: [PATCH] ci: lint workflow files with actionlint on changes to
 .github/workflows

---
 .github/workflows/actionlint.yml              | 31 +++++++++++++++++++
 .../bump_toolchain_nightly-testing.yml        |  2 +-
 .github/workflows/lean_action_ci.yml          |  2 +-
 3 files changed, 33 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/actionlint.yml

diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
new file mode 100644
index 0000000000..a8a3f0a061
--- /dev/null
+++ b/.github/workflows/actionlint.yml
@@ -0,0 +1,31 @@
+name: actionlint
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/workflows/**'
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    name: Lint workflow files
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          sparse-checkout: |
+            .github/workflows
+
+      # Also runs shellcheck over every `run:` block and pyflakes over
+      # `shell: python` steps.
+      - uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
+        with:
+          version: 1.7.12
diff --git a/.github/workflows/bump_toolchain_nightly-testing.yml b/.github/workflows/bump_toolchain_nightly-testing.yml
index 7bab15c8fc..894c166363 100644
--- a/.github/workflows/bump_toolchain_nightly-testing.yml
+++ b/.github/workflows/bump_toolchain_nightly-testing.yml
@@ -45,7 +45,7 @@ jobs:
         GH_TOKEN: ${{ steps.app-token.outputs.token }}
       run: |
         # Extract date from RELEASE_TAG (format: nightly-YYYY-MM-DD)
-        DATE_PART=$(echo "$RELEASE_TAG" | sed 's/nightly-//')
+        DATE_PART="${RELEASE_TAG#nightly-}"
         NIGHTLY_TESTING_TAG="nightly-testing-${DATE_PART}"
         echo "NIGHTLY_TESTING_TAG=$NIGHTLY_TESTING_TAG" >> "${GITHUB_ENV}"
 
diff --git a/.github/workflows/lean_action_ci.yml b/.github/workflows/lean_action_ci.yml
index d5ca8cefab..e67c4ced2c 100644
--- a/.github/workflows/lean_action_ci.yml
+++ b/.github/workflows/lean_action_ci.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Set TEST_ARGS manually
         run: |
-          echo "TEST_ARGS='--wfail --iofail'" >> $GITHUB_ENV
+          echo "TEST_ARGS='--wfail --iofail'" >> "$GITHUB_ENV"
         shell: bash
       - uses: leanprover/lean-action@v1
         with: