[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — workflows or build tooling

---

Description of your pull request and other information

Step 4 of #1967. Lint's lint job runs actionlint 1.7.12 first, since it needs no Python.

• The step downloads the release archive and checks it with sha256sum -c against a pinned sha256. The version and checksum sit in the step's env:. Dependabot does not track this pin.
• Like the other Lint steps it is advisory (continue-on-error), with a 5-minute timeout and contents: read. The run summary counts findings by rule and by shellcheck code.
• The one non-shellcheck finding is a false positive: project-status.yml's concurrency.queue, which GitHub documents but actionlint does not know yet (Actionlint does not know about queue: key for concurrency rhysd/actionlint#657). It gets a single -ignore matching only that message.
• shellcheck reports 20 findings on run: blocks, all style or info. None is a real bug; the decision on what to do with them is asked on ci: divide and simplify the workflows into scripts, shared heads and smaller files #1967.

Tests and docs:

• tests/project/test_actionlint_in_lint_1967.py pins the step. It fails against main (5 failed).
• workflows.rst gains a Workflow Lint section.

Part of #1967.

[JarryShaw]

GOOD TO GO at 7f8406e7b. A Sonnet review checked:

• Checksum. The pinned sha256 matches the actionlint_1.7.12_linux_amd64.tar.gz line of the release's checksums file, and sha256sum -c passes on a fresh download. v1.7.12 is the latest release.
• The ignore. Actionlint does not know about queue: key for concurrency rhysd/actionlint#657 is open and confirms 1.7.12 lacks concurrency.queue. The fix PR SOLUTION's Reserved octet is written as a PUZZLE Lifetime, and lifetime=0 escapes a bare ValueError from math.log2 #654 is unmerged. The anchored -ignore removes exactly that finding and nothing else.
• Safety. The step interpolates no event data. A failed download or checksum aborts before extraction, and continue-on-error keeps the job green.
• Tests. The new pin and the lint.yml pins pass.

The shellcheck findings stay advisory pending the choice on #1967.

[github-actions]

Coverage: 91.55% (unit tier, Python 3.15, 7f8406e7b, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19597	881	2618	867	92.11%
pcapkit/corekit	2542	71	810	37	96.54%
pcapkit/dumpkit	276	3	100	3	98.40%
pcapkit/foundation	2930	23	1022	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17501	222	4612	187	98.13%
pcapkit/toolkit	872	36	298	10	95.21%
pcapkit/utilities	523	2	158	4	99.12%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.