* Fix evaluation.yml: quote run-name so '#' is not parsed as a YAML comment
The run-name added in #746 is an unquoted plain scalar containing
` #{0}`. In YAML, a space followed by '#' starts a comment, so everything
from '#{0} ...' onward was stripped, leaving an unterminated ${{ }}
expression. The file still parses as YAML (yaml.safe_load succeeds) but
GitHub Actions rejects it ("This run likely failed because of a workflow
file issue"), which broke every evaluation run on main after #746 merged.
Wrapping the value in double quotes keeps the full expression intact;
verified with actionlint.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add authoring-github-workflows skill + actionlint CI gate
Prevents the class of bug that broke evaluation on main (#746): an unquoted
`${{ }}` workflow expression containing `#`, which YAML treats as a comment
and silently truncates, producing a file that parses as YAML but that GitHub
Actions refuses to run ("This run likely failed because of a workflow file
issue", no jobs started).
Two layers:
- Knowledge: .agents/skills/authoring-github-workflows/SKILL.md teaches the
`#`-as-comment trap and other quoting rules, and to validate with actionlint
(plain YAML linters accept the truncated form).
- Enforcement: .github/workflows/actionlint.yml runs a pinned actionlint on
hand-authored workflows for any PR/push touching .github/workflows. Generated
gh-aw files (DO NOT EDIT headers) are skipped; shellcheck/pyflakes are off so
the gate focuses on workflow/expression errors. .github/actionlint.yaml
declares the repo's custom runner labels (ubuntu-slim, windows-11-arm).
Verified locally: actionlint exits 0 on all hand-authored workflows, and
exits 1 on the original unquoted run-name, confirming the gate catches it.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix markdownlint MD038: remove spaces inside code spans in SKILL.md
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review comments: actionlint config trigger, curl -f, syntactic-vs-semantic scope
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Harden actionlint workflow: pin checkout to SHA, disable persisted creds, verify actionlint checksum
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
dependabot[bot]