platform-ci/source_tools/scripts/actionlint-verify.sh

#!/usr/bin/env bash
# Optional legacy gate (source-verify actionlint=true): the pinned actionlint over the repository's own
# .github/workflows/*.yml, the exact `-color` invocation the original workflow-lint job ran. Nothing from the
# repository is executed. An empty or missing glob fails: a requested gate must not pass by linting nothing.
# env: INSTALL_TOOL (tests replace the pinned install)
set -eu
here=$(cd "$(dirname "$0")" && pwd)
# shellcheck disable=SC1091
. "$here/../tools.env"
install_tool=${INSTALL_TOOL:-$here/install-tool.sh}
dest=$(mktemp -d)
trap 'rm -rf "$dest"' EXIT
bash "$install_tool" actionlint "$dest"
[ "$("$dest/actionlint" --version | head -n 1)" = "$ACTIONLINT_VERSION" ] || { echo "actionlint-verify: version mismatch" >&2; exit 1; }
shopt -s nullglob
files=(.github/workflows/*.yml)
[ "${#files[@]}" -gt 0 ] || { echo "actionlint-verify: no .github/workflows/*.yml to lint" >&2; exit 1; }
"$dest/actionlint" -color "${files[@]}"