v1.11.0

What's changed

• Replace the Python action entrypoint with a Go program that reuses the actionlint package directly, keeping every declared input, output, format, and failure mode, and confining all workspace file access to an os.Root handle. (#16)
• Replace scripts/bump-version.bash with a Go tool that declares every version-bearing file and its expected occurrence count, verifies each update, refuses to run on a dirty tree or an existing tag, and pushes only with an explicit flag. (#17)
• Raise the minimum Go version to 1.26 with Go 1.27 as the CI default, replace the 6x2 test matrix with seven targeted jobs plus one race and coverage job, cancel superseded pull request runs, and pin every action and Docker base image to a commit SHA. (#14)
• Consolidate the JavaScript tooling into a single root npm workspace with one lockfile. (#15)
• Add a first-party Docker action with validated inputs, GitHub annotations, multiple output formats, and structured result outputs, following up on rhysd#257 and rhysd#479. Release images are published as action-{version}, action-v1, and action-latest, so consumer workflows pull a prebuilt actionlint, ShellCheck, and pyflakes image instead of compiling actionlint. Releases also update the moving v1 Git tag for kjanat/actionlint@v1. (#5)
• Harden the Docker action and its release path by containing configuration and workflow inputs within the workspace, rejecting option-like paths and directory output destinations before linting, bounding actionlint execution time, pinning the Alpine runtime, defaulting the CLI image to /w, serializing releases before moving mutable image aliases, and verifying every expected version replacement independently.
• Restore the generated command manual to the fork's Pages deployment at usage.html and man.html, add a 404.html fallback, and document whether each third-party integration uses this fork, upstream actionlint, or a configurable local executable.
• Report ShellCheck findings at their exact YAML source locations for literal block and plain run: scripts, including precise ranges. Scalar forms that cannot be mapped safely continue to report at the run: key. (rhysd#88, rhysd#360; building on the direction explored in rhysd#556, thanks @dpsutton)
• Update the playground's preloaded workflow to the current major versions of actions/checkout, actions/setup-node, and actions/cache.