Add GitHub Actions workflow validation system

[Copilot]

Purpose

Implements automated validation for GitHub Actions workflows to ensure actions remain available and up-to-date.

• Validates workflow YAML syntax and structure using actionlint
• Verifies all referenced actions exist and are accessible via GitHub API
• Detects outdated action versions by comparing against latest releases
• Generates audit reports with action inventory
• Runs weekly (Mondays 9:00 UTC) plus on workflow changes

Does this introduce a breaking change?

[ ] Yes
[x] No

Pull Request Type

[ ] Bugfix
[x] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

• Test the code

# Validate workflows locally
curl -sL https://github.com/rhysd/actionlint/releases/download/v1.7.9/actionlint_1.7.9_linux_amd64.tar.gz -o actionlint.tar.gz
tar xzf actionlint.tar.gz
./actionlint .github/workflows/*.yml

# Build the project
npm run build

What to Check

Verify that the following are valid

• Workflow validation job runs and completes successfully
• CI build job completes without errors
• Action availability check identifies all actions in use
• Weekly schedule trigger is configured correctly
• Explicit permissions are set on all jobs (principle of least privilege)
• Downloadable report artifact is generated

Other Information

Implementation Details:

• actionlint v1.7.9 pinned with SHA256 checksum verification
• GitHub REST API 2022-11-28 with authentication for rate limits
• jq for robust JSON parsing
• Handles actions with and without explicit versions

Security:

• Explicit contents: read permissions on all jobs
• Checksum verification for downloaded tools
• No secrets exposed in logs
• CodeQL validated (0 alerts)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Validate workflow files</issue_title>
<issue_description>- create workflow to validate all gh actions and workflows

• verify actions are still available and using the lastest version of the action
• what else? </issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Validate workflow files #22

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.