[EngSys] Lint workflows with actionlint

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - 1ES.Pool=azsdk-pool-github-runners

.github/matchers/actionlint.json

@@ -0,0 +1,17 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "actionlint",
+      "pattern": [
+        {
+          "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4,
+          "code": 5
+        }
+      ]
+    }
+  ]
+}

.github/workflows/actionlint.yml

@@ -0,0 +1,35 @@
+name: Actionlint
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - .github/**
+  pull_request:
+    paths:
+      - .github/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            .github
+
+      # Content copied from https://raw.githubusercontent.com/rhysd/actionlint/2ab3a12c7848f6c15faca9a92612ef4261d0e370/.github/actionlint-matcher.json
+      - name: Add ActionLint Problem Matcher
+        run: echo "::add-matcher::.github/matchers/actionlint.json"
+
+      - name: Lint workflows
+        uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
+        with:
+          args: -color -verbose

.github/workflows/azure-sdk-tools.yml

@@ -12,10 +12,10 @@ jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
       - name: Set up Python 3.13
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: 3.13
 
@@ -24,7 +24,7 @@ jobs:
 
       - name: Install azure-sdk-tools
         run: |
-          python -m pip install -e eng/tools/azure-sdk-tools[ghtools,conda]
+          python -m pip install -e 'eng/tools/azure-sdk-tools[ghtools,conda]'
           python -m pip freeze
         shell: bash
 
@@ -37,10 +37,10 @@ jobs:
   static-analysis:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
       - name: Set up Python 3.13
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: 3.13
 
@@ -49,7 +49,7 @@ jobs:
 
       - name: Install azure-sdk-tools
         run: |
-          python -m pip install -e eng/tools/azure-sdk-tools[ghtools,conda]
+          python -m pip install -e 'eng/tools/azure-sdk-tools[ghtools,conda]'
           python -m pip install black==24.4.0
           python -m pip freeze
         shell: bash
@@ -62,10 +62,10 @@ jobs:
   verify-azpysdk-checks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
       - name: Set up Python 3.13
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: 3.13
 
@@ -79,7 +79,7 @@ jobs:
 
       - name: Install azure-sdk-tools on in global uv, discover azpysdk checks
         run: |
-          uv pip install --system -e eng/tools/azure-sdk-tools[ghtools,conda,systemperf]
+          uv pip install --system -e 'eng/tools/azure-sdk-tools[ghtools,conda,systemperf]'
 
           # Discover available azpysdk commands from the {command1,command2,...} line in help output
           CHECKS=$(azpysdk -h 2>&1 | \
@@ -102,20 +102,20 @@ jobs:
 
       - name: Run all discovered checks against azure-template using uv as package manager
         run: |
-          sdk_build azure-template -d $(pwd)/wheels --build_id 20250101.1
-          python eng/scripts/dispatch_checks.py --checks "$AZPYSDK_CHECKS" --wheel_dir $(pwd)/wheels azure-template
+          sdk_build azure-template -d "$(pwd)/wheels" --build_id 20250101.1
+          python eng/scripts/dispatch_checks.py --checks "$AZPYSDK_CHECKS" --wheel_dir "$(pwd)/wheels" azure-template
         shell: bash
         env:
           AZPYSDK_PIP_IMPL: "uv"
 
       - name: Install azure-sdk-tools on global pip env
         run: |
-          python -m pip install -e eng/tools/azure-sdk-tools[ghtools,conda]
+          python -m pip install -e 'eng/tools/azure-sdk-tools[ghtools,conda]'
         shell: bash
 
       - name: Run all discovered checks against azure-template using pip as package manager
         run: |
-          python eng/scripts/dispatch_checks.py --checks "$AZPYSDK_CHECKS" --wheel_dir $(pwd)/wheels azure-template
+          python eng/scripts/dispatch_checks.py --checks "$AZPYSDK_CHECKS" --wheel_dir "$(pwd)/wheels" azure-template
         shell: bash
         env:
           AZPYSDK_PIP_IMPL: "pip"

.github/workflows/copilot-setup-steps.yml

@@ -11,10 +11,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: '3.10'
           cache: 'pip'
@@ -23,8 +23,8 @@ jobs:
         run: |
           python -m venv .venv
           source .venv/bin/activate
-          echo "VIRTUAL_ENV=$(pwd)/.venv" >> $GITHUB_ENV
-          echo "$(pwd)/.venv/bin" >> $GITHUB_PATH
+          echo "VIRTUAL_ENV=$(pwd)/.venv" >> "$GITHUB_ENV"
+          echo "$(pwd)/.venv/bin" >> "$GITHUB_PATH"
 
       - name: Install Dependencies
         run: |

.github/workflows/dependency-checker.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: 3.11
 

.github/workflows/typespec-python-regenerate.yml

@@ -80,11 +80,13 @@ jobs:
             exit 1
           fi
 
-          echo "typespec_repo=$REPO" >> $GITHUB_OUTPUT
-          echo "typespec_ref=$REF" >> $GITHUB_OUTPUT
-          echo "typespec_display_ref=$DISPLAY_REF" >> $GITHUB_OUTPUT
-          echo "typespec_ref_url=$REF_URL" >> $GITHUB_OUTPUT
-          echo "typespec_pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
+          {
+            echo "typespec_repo=$REPO"
+            echo "typespec_ref=$REF"
+            echo "typespec_display_ref=$DISPLAY_REF"
+            echo "typespec_ref_url=$REF_URL"
+            echo "typespec_pr_number=$PR_NUMBER"
+          } >> "$GITHUB_OUTPUT"
           echo "::notice::Regenerating from ${REPO}@${DISPLAY_REF}"
 
       - name: Checkout microsoft/typespec
@@ -206,7 +208,9 @@ jobs:
 
           # Restore regenerated files from the temp dir.
           mkdir -p "$GENERATED_DIR"
-          rm -rf "$GENERATED_DIR"/*
+          # Use ${var:?} so that if GENERATED_DIR is empty, the command aborts
+          # instead of expanding to "rm -rf /*" and deleting the filesystem.
+          rm -rf "${GENERATED_DIR:?}"/*
           cp -r "$TMPDIR"/. "$GENERATED_DIR"
           rm -rf "$TMPDIR"
           git add -f "$GENERATED_DIR"/