chore(ci): replace actionlint with zizmor

[jdx]

GitHub now recommends the $/ self-repository syntax, and zizmor 1.30.0 audits the older ./ form. actionlint 1.7.12 does not recognize $/, which made the earlier version of this PR fail its own lint job.

Remove actionlint from usage's toolchain, lint tasks, lockfile, and repository-specific configuration. Keep the trusted and untrusted test workflow calls on $/; the existing zizmor workflow now provides the maintained GitHub Actions audit.

Validation:

• zizmor 1.30.0 passed with online audits enabled
• mise lock --dry-run --json returned []
• mise tasks loaded the updated task configuration
• git diff --check origin/main...HEAD passed

AI-assisted — Tool: Codex; model: OpenAI/GPT-5; version: unavailable.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: f4c18e6c-f83b-4167-9d53-5246d323b10f

📥 Commits

Reviewing files that changed from the base of the PR and between cc3b0a4 and b7a575b.

⛔ Files ignored due to path filters (1)

• mise.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• .cursor/install.sh
• .github/actionlint.yaml
• mise.toml

💤 Files with no reviewable changes (2)

• mise.toml
• .github/actionlint.yaml

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The test workflow updates reusable workflow references for the trusted and untrusted jobs. The repository removes actionlint configuration, installation metadata, and the mise lint task.

Changes

Test workflow and lint configuration

Layer / File(s)	Summary
Reusable workflow references .github/workflows/test.yml	The trusted and untrusted jobs now reference the updated test-impl.yml path. Their conditions and trusted inputs remain unchanged.
Actionlint removal mise.toml, .github/actionlint.yaml, .cursor/install.sh	The actionlint tool, lint task, configuration, and installation comment entry are removed.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to b7a57

The workflow reference updates and actionlint cleanup are ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main CI change: replacing actionlint with zizmor.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
markdown	▅▅████▁▁▁▁▁	384,243,171 → 384,236,861	-0.00%	65.03 → 64.11ms	-1.42%
startup	▁▁█▄▄▄▄▄▄▃▄	981,111 → 988,147	+0.72%	1.35 → 1.42ms	+5.24%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

Shadow comparison

Parsing mise use -g node@20 against a shadow of mise's committed spec.
Reported, not gated: the shadow grows as the derive learns to express more, so
what to watch is the ratio rather than either column.

framework	stripped binary, bytes
usage	1349840
bpaf	2493216
clap	3101656

framework	instructions, cold parse	vs usage
usage	8607	—
clap	6314338	733x
bpaf	21909171	2545x

                                              min       p01       p10    median
usage-rs: argv -> struct                      769       770       772       787  ns
clap: build tree + parse -> struct        1231902   1236398   1246996   1264023  ns
bpaf: build parser + parse -> struct      3366892   3366892   3394106   3601468  ns

usage: argv -> struct                             819 ns      0.82 µs
clap: build tree + parse -> struct            1266990 ns   1266.99 µs
clap: parse -> struct, tree reused              49922 ns     49.92 µs
clap: build tree only                          759570 ns    759.57 µs

_{b7a575b02337 vs 408793affa81 · measured on the runner, not pushed to the history.}

[greptile-apps]

Confidence Score: 4/5

The PR is not safe to merge because its new reusable-workflow references prevent the primary pull-request and main-branch test workflow from starting.

Findings

1.  Invalid workflow reference ▶
2.  Workflow validation removed ▶

Summary

• The new reusable-workflow references are not valid GitHub Actions references, preventing the test workflow from starting.
• The actionlint tool, task, lock data, and configuration are removed without an equivalent general workflow validator.

_{Reviews (1) · Last reviewed commit: "chore(ci): replace actionlint with zizmo..."}

[greptile-apps]

Invalid workflow reference

GitHub Actions accepts same-repository reusable workflows through the ./.github/workflows/<workflow> form, not $/.github/workflows/test-impl.yml. Both this job and the untrusted job on line 23 use the unsupported form, so pull requests and pushes to main fail workflow validation instead of running the test workflow. The reported zizmor audit does not validate that GitHub can resolve this reference.

[greptile-apps]

Workflow validation removed

Removing lint:actionlint eliminates general GitHub Actions validation from both the CI lint job and the pre-commit lint hook. Zizmor performs security auditing rather than equivalent workflow syntax, expression, structure, and runner-label validation. Future workflow mistakes can therefore merge without being caught by the repository's lint suite; retain actionlint or add an equivalent validator.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!