Development

Before pushing

CI runs the same:

yamllint .
ansible-lint
ansible-playbook --syntax-check daily-driver.yml
pytest tests/

tests/test_consistency.py checks that the README lists every runnable tag, every role has a row in roles/README.md, the zsh / tmux plugins are pinned to a full commit and Renovate's regex finds each one, and the Galaxy and CI versions are pinned.
.ansible-lint has a skip_list of rules deliberately deferred rather than turned off; each entry says what it covers.

Lint (Ubuntu): yamllint, ansible-lint, syntax check, pytest.
Check mode (macOS): clones the dotfiles, runs the taps tag for real (a tap isn't added in check mode, and installing from it would then fail), then the whole playbook with --check and no sudo password. It catches what the syntax check can't: an undefined variable, a when on a missing result.
The Galaxy collections are cached on requirements.yml, so CI downloads them only when it changes: Galaxy now and then answers 500, sometimes for hours. scripts/install-collections.sh downloads them, and when Galaxy fails installs the same versions from their GitHub repos (ansible-collections/<name> at the tag <version>).

Renovate (renovate.json, the Renovate GitHub app), on the 1st and 15th:

the GitHub Actions (pinned to a commit, the version in a comment)
the CI lint tools in requirements-ci.txt
the zsh and tmux plugins pinned to a commit (zsh_plugins, tmux_plugins), in one PR, moved to master's newest commit

The Galaxy collections in requirements.yml are not updated automatically.

A new tool: in the role and task file that fits, with its own tag; if it adds a runnable tag (a new task file), list it in the README's tags section (the test fails otherwise).
A new role: a row in roles/README.md, with a link to its README if it has one.
Something the dotfiles install: in the dotfiles' install.sh, not here; a file copied to ~ goes in the dotfiles' home-files list.
A pinned plugin: a full commit in zsh_plugins / tmux_plugins, in the layout Renovate's regex expects.