From 54c91058fd78d91dadde872438c8fcd979d32080 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Wed, 21 Oct 2026 11:02:25 -0600
Subject: [PATCH 1/3] ci: share actionlint configuration across checks

---
 .github/actionlint.yaml     | 6 ++++++
 .github/workflows/lint.yaml | 3 +--
 .mega-linter.yml            | 2 ++
 prek.toml                   | 2 --
 4 files changed, 9 insertions(+), 4 deletions(-)
 create mode 100644 .github/actionlint.yaml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..f53d3bd
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,6 @@
+# actionlint v1.7.12 predates GitHub background/wait steps.
+paths:
+  .github/workflows/release.yaml:
+    ignore:
+      - '^unexpected key "background" for step to execute action\.'
+      - '^step must run script with "run" section or run action with "uses" section$'
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 9314776..3a78650 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -33,7 +33,6 @@ jobs:
 
       - name: megalinter
         uses: oxsecurity/megalinter@9949bad031045f366be2467e00e8371a7328a2e2 # v10
-        if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VALIDATE_ALL_CODEBASE: false
+          VALIDATE_ALL_CODEBASE: true
diff --git a/.mega-linter.yml b/.mega-linter.yml
index 0050ad4..870fd27 100644
--- a/.mega-linter.yml
+++ b/.mega-linter.yml
@@ -1,4 +1,6 @@
 ENABLE_ERRORS_LINTERS:
   - ACTION_ACTIONLINT
 
+ACTION_ACTIONLINT_CONFIG_FILE: LINTER_DEFAULT
+
 BASH_SHFMT_ARGUMENTS: ["-i", "4", "-ci", "-w"]
diff --git a/prek.toml b/prek.toml
index 887061a..44554ba 100644
--- a/prek.toml
+++ b/prek.toml
@@ -53,8 +53,6 @@ rev = "v1.7.12"
 
 [[repos.hooks]]
 id = "actionlint"
-# v1.7.12 predates GitHub's background/wait steps; GitHub validates their syntax.
-args = ['-ignore', 'unexpected key "background" for step', '-ignore', 'step must run script with "run" section or run action with "uses" section']
 files = "^\\.github/workflows/"
 
 [[repos]]

From aa932b10c9421e9cd429d22c3108d61bdb6ac7fa Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Wed, 21 Oct 2026 11:38:51 -0600
Subject: [PATCH 2/3] ci: restrict lint workflow token permissions

---
 .github/workflows/lint.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 3a78650..2621b50 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -6,6 +6,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint

From 27747412c6508a8cd8d31aae7553d309a92a865a Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Wed, 21 Oct 2026 12:40:52 -0600
Subject: [PATCH 3/3] ci: disable write-dependent MegaLinter comments

---
 .mega-linter.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.mega-linter.yml b/.mega-linter.yml
index 870fd27..d82ba58 100644
--- a/.mega-linter.yml
+++ b/.mega-linter.yml
@@ -2,5 +2,6 @@ ENABLE_ERRORS_LINTERS:
   - ACTION_ACTIONLINT
 
 ACTION_ACTIONLINT_CONFIG_FILE: LINTER_DEFAULT
+GITHUB_COMMENT_REPORTER: false
 
 BASH_SHFMT_ARGUMENTS: ["-i", "4", "-ci", "-w"]