ci: share actionlint configuration across checks

.github/actionlint.yaml

@@ -0,0 +1,6 @@
+# actionlint v1.7.12 predates GitHub background/wait steps.
+paths:
+  .github/workflows/release.yaml:
+    ignore:
+      - '^unexpected key "background" for step to execute action\.'
+      - '^step must run script with "run" section or run action with "uses" section$'

.github/workflows/lint.yaml

@@ -6,6 +6,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint
@@ -33,7 +36,6 @@ jobs:
 
       - name: megalinter
         uses: oxsecurity/megalinter@9949bad031045f366be2467e00e8371a7328a2e2 # v10
-        if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VALIDATE_ALL_CODEBASE: false
+          VALIDATE_ALL_CODEBASE: true

.mega-linter.yml

@@ -1,4 +1,7 @@
 ENABLE_ERRORS_LINTERS:
   - ACTION_ACTIONLINT
 
+ACTION_ACTIONLINT_CONFIG_FILE: LINTER_DEFAULT
+GITHUB_COMMENT_REPORTER: false
+
 BASH_SHFMT_ARGUMENTS: ["-i", "4", "-ci", "-w"]

prek.toml

@@ -53,8 +53,6 @@ rev = "v1.7.12"
 
 [[repos.hooks]]
 id = "actionlint"
-# v1.7.12 predates GitHub's background/wait steps; GitHub validates their syntax.
-args = ['-ignore', 'unexpected key "background" for step', '-ignore', 'step must run script with "run" section or run action with "uses" section']
 files = "^\\.github/workflows/"
 
 [[repos]]