Guard workflow syntax and exact pushed refs before research publication

[Clear1nsight]

Scope

Tooling-only safeguard against invalid GitHub Actions syntax/expression contexts, including the P112 runner.temp job-level environment regression. Based on fork main 155f57f1ff4d431f6ef96104fdb47d4017ac7382, which already contains the reviewed correction from #8 / CrocSwap#3885.

• Pin official actionlint 1.7.12 release binaries with platform-specific SHA-256 verification
• Add an independent workflow-lint job on every push and PR, plus manual dispatch, without branch/path/repository filters
• Validate the complete exact Git tree, including reusable workflow and local-action metadata checks; disable Git replacement-object substitutions
• Provide an opt-in pre-push hook that checks every pushed non-deletion object, including non-checked-out branches and annotated commit tags
• Document stable hook installation and reviewed CI overlays on intentionally frozen scientific bases

Existing workflows, permissions, branch protection, research packages, selected-source pins, upstream archives, intake history and contributor credits are unchanged. No hook configuration is installed automatically. The new lint workflow has read-only contents permission and disables checkout credential persistence.

Verification

• All 136 workflows in the proposed tree pass actionlint 1.7.12 (native syntax/context/expression checks enabled, no ignore filters)
• 24 regression tests pass, including bad job-level runner.temp, invalid YAML/expressions, reusable/local action metadata, exact pushed refs, dirty checkouts, replacement refs, linked worktrees, and symlink rejection
• Real temporary-repository pushes independently verified that the hook blocks an invalid non-checked-out branch and permits a valid exact SHA
• Original upstream 20ecf2891d80b5acf18d980b2164fb44ea7faa90: all 139 workflows inspected; the expected P112 line 19 expression-context error is correctly rejected
• Official checksum-pinned installer exercised successfully on Linux amd64
• git diff --check passes

Commands:

python3 scripts/install_actionlint.py --directory /tmp/actionlint
export PATH="/tmp/actionlint:$PATH"
python3 -B scripts/check_workflows.py --ref HEAD
python3 -B -m unittest discover -s tests -p test_workflow_validation.py -v

All 136 workflows also passed the exact-commit check at 14e598894a2c37fdf5fab7fc2f6572ce8d29bae1 before the branch was published. Remote CI passed: exact-head push lint, PR lint, and registered-package planning. The planning job’s 253-test onboarding/helper suite completed successfully (242 passed, 11 skipped) and selected no packages; its scientific replay job was correctly skipped. Workflow lint is not scientific replay or theorem approval; no historical, Lean, Docker, or mathematical replay is claimed by this change. Optional external ShellCheck/Pyflakes integrations are deliberately outside this workflow-syntax gate.

Credit and follow-up

Retains the reviewed P112 correction from #8 / CrocSwap#3885. Prepared with OpenAI assistance. The remaining deployment step is maintainer review/merge and explicit local hook opt-in; adoption onto existing research branches must respect their scope and owners.