fix(ci): remove invalid workflow permission and lint workflows

[hoangsvit]

Summary

Fix the invalid GitHub Actions workflow error:

(Line: 18, Col: 3): Unexpected value 'metadata'

Root cause

metadata is not a supported key inside the GitHub Actions permissions: block. It was mistakenly added to .github/workflows/dependabot-auto-merge.yml, causing GitHub to reject the entire workflow before any job could start.

Changes

• Remove metadata: read from the Dependabot auto-merge workflow.
• Search confirmed that this was the only occurrence in the repository.
• Add a pinned actionlint validation step to CI.
• Verify the downloaded actionlint archive using its published SHA-256 checksum.

Expected result

• dependabot-auto-merge.yml becomes valid again.
• Future invalid workflow keys and schema errors fail in the normal CI pull request before reaching main.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[eplus-bot]

Thank you for creating this pull request and helping make the project better.

We will review / merge it when we are online.

[deepsource-io]

DeepSource Code Review

We reviewed changes in c81e8fe...49d256d on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Jul 14, 2026 11:47p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[github-actions]

Thanks for helping make Gmail Alias Toolkit better!