37896802481
67%
develop: 67%

Ran 09 Oct 2026 07:03AM UTC

Jobs 1

Files 79

Run time 1min

Badge

Embed ▾

Committed 09 Oct 2026 07:02AM UTC coverage: 66.737%. Remained the same

Build # 37896802481

Build Type

push

github

Committed by

web-flow

Commit Message

ci: lint GitHub Actions workflows with jactionlint (#7069)

Adds [jactionlint](https://github.com/jdx/jactionlint) as a core lint
for our GitHub Actions workflows and runs it as part of `check:all`.

- Replaces `.github/actionlint.yaml` with `.github/jactionlint.yaml` and
enables `require-commit-hash`, so actions, reusable workflows, and
`docker://` images must be pinned to a full SHA or digest.
- Pins `jactionlint` and `shellcheck` through mise. jactionlint only
checks `run:` scripts when shellcheck is on `PATH`, so pinning it keeps
local and CI results the same.
- Adds a root `lint:actions:check` script, registers it as an uncached
Turbo task, and includes it in `check:all`.

Fixes for existing findings:

- The `publish` jobs in `cli-go-pg-prove.yml` and
`cli-go-publish-migra.yml` now grant `packages: write` and `id-token:
write`. The reusable `cli-go-mirror-image.yml` workflow needs both, and
these callers only had the workflow-level `contents: read`.
- `$GITHUB_OUTPUT` redirects in workflow scripts are now quoted.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Julien Goux <hi@jgoux.dev>

Coverage Stats

4097 of 6139 relevant lines covered (66.74%)

7.37 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	37896802481.1	09 Oct 2026 07:03AM UTC	79	66.74	GitHub Action Run

supabase / cli / 37896802481
67%
develop: 67%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 37896802481

supabase / cli / 37896802481 67% develop: 67%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 37896802481

supabase / cli / 37896802481
67%
develop: 67%

README BADGES
x