test: Add linting

.github/workflows/actionlint.yml

@@ -0,0 +1,28 @@
+# Lints all workflow files in this repo with actionlint (self-check, not a reusable workflow).
+name: Actionlint
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run actionlint
+        uses: reviewdog/action-actionlint@50842263c20a7c46bd0065b9e624d3c569db061e # v1.73.0
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          reporter: github-check
+          fail_level: error

.github/workflows/semver-container.yml

@@ -37,7 +37,7 @@ jobs:
       # so we normalise it here and store it in GITHUB_ENV for all subsequent steps.
       - name: downcase repo-owner
         run: |
-          echo "REPO_OWNER_LOWER=${GITHUB_REPOSITORY_OWNER,,}" >>${GITHUB_ENV}
+          echo "REPO_OWNER_LOWER=${GITHUB_REPOSITORY_OWNER,,}" >> "${GITHUB_ENV}"
 
       - name: Parse version from tag
         id: version
@@ -52,19 +52,23 @@ jobs:
           # the exact patch, following standard container image tagging conventions.
           major=$(echo "$version" | cut -d. -f1)
           minor=$(echo "$version" | cut -d. -f2)
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-          echo "major=$major" >> "$GITHUB_OUTPUT"
-          echo "major-minor=$major.$minor" >> "$GITHUB_OUTPUT"
 
           # A hyphen in the version string indicates a pre-release (e.g. 1.0.0-beta.1).
           # Floating major/minor tags must NOT be applied to pre-releases — those tags
           # should always point at the latest stable release, not a pre-release build.
           if [[ "$version" == *-* ]]; then
-            echo "is-prerelease=true" >> "$GITHUB_OUTPUT"
+            is_prerelease=true
           else
-            echo "is-prerelease=false" >> "$GITHUB_OUTPUT"
+            is_prerelease=false
           fi
 
+          {
+            echo "version=$version"
+            echo "major=$major"
+            echo "major-minor=$major.$minor"
+            echo "is-prerelease=$is_prerelease"
+          } >> "$GITHUB_OUTPUT"
+
       # Verify that the edge image built from this commit SHA actually exists in the registry
       # before attempting to retag it. Fails fast rather than producing a misleading error
       # from the tag-push step if the publish-container workflow hasn't run yet.