diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 000000000000..07a7d5c18898
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - 1ES.Pool=azsdk-pool-github-runners
diff --git a/.github/matchers/actionlint.json b/.github/matchers/actionlint.json
new file mode 100644
index 000000000000..4613e1617bfe
--- /dev/null
+++ b/.github/matchers/actionlint.json
@@ -0,0 +1,17 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "actionlint",
+      "pattern": [
+        {
+          "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4,
+          "code": 5
+        }
+      ]
+    }
+  ]
+}
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
new file mode 100644
index 000000000000..4f3c0386c11d
--- /dev/null
+++ b/.github/workflows/actionlint.yml
@@ -0,0 +1,35 @@
+name: Actionlint
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - .github/**
+  pull_request:
+    paths:
+      - .github/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            .github
+
+      # Content copied from https://raw.githubusercontent.com/rhysd/actionlint/2ab3a12c7848f6c15faca9a92612ef4261d0e370/.github/actionlint-matcher.json
+      - name: Add ActionLint Problem Matcher
+        run: echo "::add-matcher::.github/matchers/actionlint.json"
+
+      - name: Lint workflows
+        uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
+        with:
+          args: -color -verbose
diff --git a/.github/workflows/azure-sdk-tools.yml b/.github/workflows/azure-sdk-tools.yml
index a308ba49501e..e4a132167652 100644
--- a/.github/workflows/azure-sdk-tools.yml
+++ b/.github/workflows/azure-sdk-tools.yml
@@ -12,10 +12,10 @@ jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
       - name: Set up Python 3.13
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: 3.13
 
@@ -24,7 +24,7 @@ jobs:
 
       - name: Install azure-sdk-tools
         run: |
-          python -m pip install -e eng/tools/azure-sdk-tools[ghtools,conda]
+          python -m pip install -e 'eng/tools/azure-sdk-tools[ghtools,conda]'
           python -m pip freeze
         shell: bash
 
@@ -37,10 +37,10 @@ jobs:
   static-analysis:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
       - name: Set up Python 3.13
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: 3.13
 
@@ -49,7 +49,7 @@ jobs:
 
       - name: Install azure-sdk-tools
         run: |
-          python -m pip install -e eng/tools/azure-sdk-tools[ghtools,conda]
+          python -m pip install -e 'eng/tools/azure-sdk-tools[ghtools,conda]'
           python -m pip install black==24.4.0
           python -m pip freeze
         shell: bash
@@ -62,10 +62,10 @@ jobs:
   verify-azpysdk-checks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
       - name: Set up Python 3.13
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: 3.13
 
@@ -79,7 +79,7 @@ jobs:
 
       - name: Install azure-sdk-tools on in global uv, discover azpysdk checks
         run: |
-          uv pip install --system -e eng/tools/azure-sdk-tools[ghtools,conda,systemperf]
+          uv pip install --system -e 'eng/tools/azure-sdk-tools[ghtools,conda,systemperf]'
 
           # Discover available azpysdk commands from the {command1,command2,...} line in help output
           CHECKS=$(azpysdk -h 2>&1 | \
@@ -102,20 +102,20 @@ jobs:
 
       - name: Run all discovered checks against azure-template using uv as package manager
         run: |
-          sdk_build azure-template -d $(pwd)/wheels --build_id 20250101.1
-          python eng/scripts/dispatch_checks.py --checks "$AZPYSDK_CHECKS" --wheel_dir $(pwd)/wheels azure-template
+          sdk_build azure-template -d "$(pwd)/wheels" --build_id 20250101.1
+          python eng/scripts/dispatch_checks.py --checks "$AZPYSDK_CHECKS" --wheel_dir "$(pwd)/wheels" azure-template
         shell: bash
         env:
           AZPYSDK_PIP_IMPL: "uv"
 
       - name: Install azure-sdk-tools on global pip env
         run: |
-          python -m pip install -e eng/tools/azure-sdk-tools[ghtools,conda]
+          python -m pip install -e 'eng/tools/azure-sdk-tools[ghtools,conda]'
         shell: bash
 
       - name: Run all discovered checks against azure-template using pip as package manager
         run: |
-          python eng/scripts/dispatch_checks.py --checks "$AZPYSDK_CHECKS" --wheel_dir $(pwd)/wheels azure-template
+          python eng/scripts/dispatch_checks.py --checks "$AZPYSDK_CHECKS" --wheel_dir "$(pwd)/wheels" azure-template
         shell: bash
         env:
           AZPYSDK_PIP_IMPL: "pip"
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index ac9b7148ec66..22c876c5252c 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -11,10 +11,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: '3.10'
           cache: 'pip'
@@ -23,8 +23,8 @@ jobs:
         run: |
           python -m venv .venv
           source .venv/bin/activate
-          echo "VIRTUAL_ENV=$(pwd)/.venv" >> $GITHUB_ENV
-          echo "$(pwd)/.venv/bin" >> $GITHUB_PATH
+          echo "VIRTUAL_ENV=$(pwd)/.venv" >> "$GITHUB_ENV"
+          echo "$(pwd)/.venv/bin" >> "$GITHUB_PATH"
 
       - name: Install Dependencies
         run: |
diff --git a/.github/workflows/dependency-checker.yml b/.github/workflows/dependency-checker.yml
index ccc17e88e56b..29b27f912f37 100644
--- a/.github/workflows/dependency-checker.yml
+++ b/.github/workflows/dependency-checker.yml
@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: 3.11
         
diff --git a/.github/workflows/typespec-python-regenerate.yml b/.github/workflows/typespec-python-regenerate.yml
index 3245764319a6..979f06cacfd1 100644
--- a/.github/workflows/typespec-python-regenerate.yml
+++ b/.github/workflows/typespec-python-regenerate.yml
@@ -80,11 +80,13 @@ jobs:
             exit 1
           fi
 
-          echo "typespec_repo=$REPO" >> $GITHUB_OUTPUT
-          echo "typespec_ref=$REF" >> $GITHUB_OUTPUT
-          echo "typespec_display_ref=$DISPLAY_REF" >> $GITHUB_OUTPUT
-          echo "typespec_ref_url=$REF_URL" >> $GITHUB_OUTPUT
-          echo "typespec_pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
+          {
+            echo "typespec_repo=$REPO"
+            echo "typespec_ref=$REF"
+            echo "typespec_display_ref=$DISPLAY_REF"
+            echo "typespec_ref_url=$REF_URL"
+            echo "typespec_pr_number=$PR_NUMBER"
+          } >> "$GITHUB_OUTPUT"
           echo "::notice::Regenerating from ${REPO}@${DISPLAY_REF}"
 
       - name: Checkout microsoft/typespec
@@ -206,7 +208,9 @@ jobs:
 
           # Restore regenerated files from the temp dir.
           mkdir -p "$GENERATED_DIR"
-          rm -rf "$GENERATED_DIR"/*
+          # Use ${var:?} so that if GENERATED_DIR is empty, the command aborts
+          # instead of expanding to "rm -rf /*" and deleting the filesystem.
+          rm -rf "${GENERATED_DIR:?}"/*
           cp -r "$TMPDIR"/. "$GENERATED_DIR"
           rm -rf "$TMPDIR"
           git add -f "$GENERATED_DIR"/
diff --git a/.vscode/cspell.json b/.vscode/cspell.json
index d85c58018529..2d7349a88660 100644
--- a/.vscode/cspell.json
+++ b/.vscode/cspell.json
@@ -139,6 +139,7 @@
     "conda/conda-recipes/uamqp/meta.yaml",
     "conda/conda-releaselogs/azure-mgmt.md",
     ".github/workflows/azure-sdk-tools.yml",
+    ".github/workflows/actionlint.yml",
     "sdk/ai/azure-ai-voicelive/azure/ai/voicelive/models/_*.py",
     "sdk/ai/azure-ai-voicelive/samples/**"
   ],