GRM-51: ci: add actionlint and act_runner exec for workflow verification

.gitea/workflows/auto-merge.yml

@@ -18,10 +18,14 @@ jobs:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
           VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
           PYTHONPATH: src
+          HEAD_REF: ${{ github.head_ref }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.number }}
         run: |
           python3 scripts/ci/auto_merge.py \
-            "${{ github.head_ref }}" \
-            "${{ github.event.pull_request.title }}" \
-            "${{ github.repository }}" \
-            "${{ github.event.number }}" \
+            "$HEAD_REF" \
+            "$PR_TITLE" \
+            "$REPOSITORY" \
+            "$PR_NUMBER" \
             "ready-to-merge"

.gitea/workflows/ci.yml

@@ -13,9 +13,16 @@ jobs:
       - uses: actions/checkout@v4
       - name: Set up environment
         run: make setup
+      - name: Install actionlint
+        run: |
+          set -euo pipefail
+          mkdir -p "$HOME/.local/bin"
+          bash <(curl -sL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) latest "$HOME/.local/bin"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - name: Lint all
         run: |
           . .venv/bin/activate
+          export PATH="$HOME/.local/bin:$PATH"
           make lint-all
       - name: Unit tests with 100% coverage
         run: |
@@ -150,14 +157,14 @@ jobs:
           # Skip if runner index exceeds available runners
           if [ "$RUNNER_INDEX" -gt "$MAX_RUNNERS" ]; then
             echo "Skipping — runner index $RUNNER_INDEX > max runners $MAX_RUNNERS"
-            echo "TEST_PAIRS=" >> $GITHUB_ENV
-            echo "SKIP=true" >> $GITHUB_ENV
+            echo "TEST_PAIRS=" >> "$GITHUB_ENV"
+            echo "SKIP=true" >> "$GITHUB_ENV"
             exit 0
           fi
           PAIRS=$(python3 scripts/ci/distribute_molecule.py --runner-index "$RUNNER_INDEX" --max-runners "$MAX_RUNNERS")
           echo "Assigned pairs: $PAIRS"
-          echo "TEST_PAIRS=$PAIRS" >> $GITHUB_ENV
-          echo "SKIP=false" >> $GITHUB_ENV
+          echo "TEST_PAIRS=$PAIRS" >> "$GITHUB_ENV"
+          echo "SKIP=false" >> "$GITHUB_ENV"
       - name: Run molecule tests
         if: env.SKIP != 'true'
         run: |
@@ -167,6 +174,7 @@ jobs:
             echo "No test pairs assigned — skipping"
             exit 0
           fi
+          # shellcheck disable=SC2086 # intentional word splitting for argument expansion
           python3 scripts/ci/molecule_ci_guard.py $TEST_PAIRS
         env:
           GITEA_URL: ${{ github.server_url }}

.gitea/workflows/post-merge.yml

@@ -155,7 +155,7 @@ jobs:
           git checkout --orphan badges
           git rm -rf .
           cp -r .badges/* .
-          git add *.svg
+          git add ./*.svg
           git commit --no-verify -m "Update badges [skip ci]"
           git push origin badges --force
       - name: Notify on failure