No CI job runs actionlint or shellcheck, so their warnings on the workflows and the shell scripts go unseen #277

Found by lane openRepoTools-2's independent review of #228's pull request 3, now #268 (its verdict is #228's comment 6273189381, NIT table row "No lint in CI", status NEW: in neither of lane 3's two fix rounds). Its mutation run found three mutants of release.yml that a linter warns about, and no job runs the linter.

What happens

• No CI job runs actionlint or shellcheck. On main 00d52ae the only workflow is tests.yml, and it names neither tool. The stack of Releases: annotated tags, release/vX.Y branches, and openrepotools on TestPyPI and PyPI from v1.1.0 #228's pull requests adds release.yml (One dispatched workflow builds the wheel, uploads it to TestPyPI, checks the install on three legs and uploads it to PyPI, and tests/test_release_workflow.py holds it (#228, PR 3 of 4) #268) and a package job to tests.yml (Every push proves the package builds, installs and runs: tests.yml gains a package job and runs on release/v* pushes, the two hash locks come from openRepoShape v1.1.0, and AGENTS.md names the four jobs (#228, PR 2 of 4) #267), and neither adds a lint job: no file under .github at the heads of openRepoTools becomes the openrepotools package: pipx installs the wheel with the whole payload, --install leaves pipx's link to pipx, --version names the release, and every count line says where the other commands come from (#228, PR 1 of 4) #262, Every push proves the package builds, installs and runs: tests.yml gains a package job and runs on release/v* pushes, the two hash locks come from openRepoShape v1.1.0, and AGENTS.md names the four jobs (#228, PR 2 of 4) #267, One dispatched workflow builds the wheel, uploads it to TestPyPI, checks the install on three legs and uploads it to PyPI, and tests/test_release_workflow.py holds it (#228, PR 3 of 4) #268, The record tells the truth about releases: the v1.0.0 notes are in the repository, the v1.1.0 notes are drafted, and README says what a release is, what --version prints and what a workstation with pipx's link sees (#228, PR 4 of 4) #269 and quickstart.md has been run and its three wrong passages fixed, the 006 docs cite the tests where they now sit, and the partial-stamp example is the line stamp_read prints (#228) #270 names either tool, bar one directive comment. The 006 tasks say so themselves: "actionlint is used by T016 and T019 to T021. Install it where it is missing; CI does not run it." (specs/006-release-pypi/tasks.md:462-463 at caa9c0f, quickstart.md has been run and its three wrong passages fixed, the 006 docs cite the tests where they now sit, and the partial-stamp example is the line stamp_read prints (#228) #270's head), and quickstart.md:122 runs it by hand, "where actionlint is installed". The code is written to shellcheck all the same: release.yml carries # shellcheck disable=SC2016 (:1463 at 29cc1b3), and tests/run.sh carries # shellcheck disable=SC2086 (:230, :239 on main).
• Measured by the review: it applied 104 mutants to release.yml and ran each under run.sh -k test_release_workflow -x -q (48 killed, 56 survived), then ran actionlint on every mutant. 101 came back clean. shellcheck flagged three: I4, I13 and N3, and all three survived the suite.
  • I4 (:1467 at 29cc1b3): 3.2.*) made *), in the macOS leg's check that the first bash on a PATH that begins with /bin is Apple's 3.2.
  • I13 (:1438): the install check's link fingerprint left unchecked.
  • N3 (:455): the clean step ("the checkout is this commit, and clean") gains exit 0 as its first line, keeping its name and its words. actionlint's SC2317 flags it.
• The failure scenario (N3): an edit puts exit 0 at the top of the clean step. The suite stays green, a dirty or moved checkout would be built, and actionlint's warning on it is shown nowhere.
• The files as written are clean: actionlint 1.7.12 on release.yml and tests.yml exits 0 at 29cc1b3 and at 1b41ce7. So the warnings above come from the mutants alone.

Where

• .github/workflows/: no job. The three mutants' lines are release.yml:1467, :1438 and :455, at 29cc1b3.

How it was found

• Lane 2's independent review of Releases: annotated tags, release/vX.Y branches, and openrepotools on TestPyPI and PyPI from v1.1.0 #228's PR 3: the "No lint in CI" NIT, and SH8's "N3 survived. actionlint's SC2317 flags it, but no CI job runs actionlint." Its mutation run and its actionlint run are the measurement, and its log is lane 2's actionlint-mutants.log.

The fix

• A CI job that runs both actionlint and shellcheck, on the workflows and on the shell scripts.

Why it is not in v1.1.0

• It needs a CI change: a new job, after PR 3's review. The review gave it as a NIT with status NEW, and no fix round took it.

Filed in milestone v1.2.0 on Brett Heap's word (2026-10-19T18:3xZ, "yes, file the v1.2.0 issues"). It is unclaimed.

Lane: openRepoTools-3

🤖 Generated with Claude Code