ci: fold actionlint into mise lint, dry-run as task (DOT-47)

.github/workflows/ci.yaml

@@ -18,22 +18,13 @@ permissions:
 
 jobs:
   lint:
-    name: Lint shell scripts, markdown, and YAML
+    name: Lint shell, markdown, YAML, and workflows
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
       - run: mise lint
 
-  actions_lint:
-    name: Lint GitHub Actions workflows
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: docker://rhysd/actionlint@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 # 1.7.12
-        with:
-          args: -color
-
   chezmoi_dry_run:
     name: Chezmoi Test (dry-run, ${{ matrix.context }})
     runs-on: macos-latest
@@ -49,11 +40,7 @@ jobs:
         with:
           context: ${{ matrix.context }}
       - name: Dry-run apply
-        run: |
-          mise exec -- chezmoi apply \
-            --source "$PWD" \
-            -n \
-            -v
+        run: mise apply-dry-run
 
   test:
     name: Run bats tests

mise.toml

@@ -1,4 +1,5 @@
 [tools]
+actionlint = "1.7.12"
 bats = "1.13.0"
 chezmoi = "2.70.3"
 prettier = "3.8.3"
@@ -19,16 +20,16 @@ run = 'chezmoi apply --verbose --source="$PWD"'
 description = "Clear chezmoi script state"
 run = "chezmoi state delete-bucket --bucket=scriptState"
 
-[tasks.reset-config]
-description = "Re-run chezmoi init data prompts for this source tree"
-run = 'chezmoi init --data=false --source="$PWD"'
+[tasks.apply-dry-run]
+description = "Preview a full chezmoi apply from this source tree without writing"
+run = 'chezmoi apply --source="$PWD" -n -v'
 
 [tasks.format]
 description = "Format all files with treefmt"
 run = "treefmt"
 
 [tasks.lint]
-description = "Check formatting with treefmt and lint shell with shellcheck"
+description = "Check formatting, lint shell, and lint GitHub Actions workflows"
 run = '''
 #!/usr/bin/env bash
 set -euo pipefail
@@ -44,6 +45,11 @@ git ls-files '*.sh' '*.zsh' '*.zshrc' | xargs shellcheck
 # Severity stays at warning because bats idioms (literal-string assertions, per-test
 # subshells) trip info-level checks that are not real bugs.
 git ls-files '*.bats' | xargs shellcheck --severity=warning
+
+# actionlint checks workflow semantics that treefmt cannot: expression syntax,
+# runner labels, job needs, and shellcheck over embedded run: scripts. It finds
+# .github/workflows on its own and picks up the shellcheck installed above.
+actionlint
 '''
 
 [tasks.test]