[DerekRoberts]

The workflow linter in PR CI ran a standalone, unconfigured actionlint container that lacked support for newer GitHub runner labels and required per-repo configuration to resolve.

Replaces docker://rhysd/actionlint:1.7.12 with bcgov/actions/pr-validate@79aefe3a7abb2d0d00b1b3ea4cfbf12727a10638 (# v0.9.0) in the actionlint job, matching the centralized canary standard. Centralized pr-validate bundles recognition for ubuntu-26.04 and ubuntu-26.04-arm, eliminating the need for local .github/actionlint.yaml config sprawl.

Refs #789, #790

Summary by CodeRabbit

• Chores
  • Updated pull request validation and workflow linting checks.
  • Added read access required for pull request validation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 6f5aa91b-2c7c-4923-aac8-7b49751f7a2a

📥 Commits

Reviewing files that changed from the base of the PR and between 20e933a and 4082e2d.

📒 Files selected for processing: 1

• .github/workflows/pr.yml

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The actionlint job now grants pull-requests: read permission and uses bcgov/actions/pr-validate v0.9.0 instead of the rhysd/actionlint container step.

Changes: PR Workflow Validation

Layer / File(s)	Summary
Update workflow validation job .github/workflows/pr.yml	The job grants pull-requests: read permission and replaces the actionlint container step with bcgov/actions/pr-validate v0.9.0. The step name changes to “Validate PR & Lint Workflows.”

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 4082e

The workflow validation change is mergeable with no identified correctness, permission, or availability risk.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adopting bcgov/actions/pr-validate for centralized workflow linting.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[kilo-code-bot]

Code Review Roast 🔥

Verdict: No Issues Found | Recommendation: Merge

Oh wait, this PR is actually clean. I need to sit down. I had my flamethrower warmed up and everything.

Three lines of CI change: a SHA-pinned third-party action, one added pull-requests: read scope, and a step rename. That's it. I checked for the usual carnage — an orphaned .github/actionlint.yaml left behind to rot (none exists, grep for actionlint now only hits this workflow), a floating tag instead of a commit pin (it's pinned to 79aefe3a… with the # v0.9.0 comment, textbook), a missing permission for the new action (it was added on the same job), and a dangling needs reference after the rename (job id actionlint is untouched, so results still resolves). Nothing. The docker://rhysd/actionlint:1.7.12 container-swap is a real improvement too: pinning an external action by immutable SHA beats trusting a mutable 1.7.12 Docker tag, and the PR body actually explains why v0.9.0 instead of the v0.10.0 the rest of this repo's bcgov/actions pins use.

I verified against the file rather than vibes: .github/workflows/pr.yml — no orphaned config, no unpinned ref, permissions still least-privilege (contents: read + pull-requests: read, top-level remains permissions: {}).

One thing I could not verify from inside this sandbox (no network fetch of bcgov/actions, and only the allowlisted gh reads available): whether pr-validate needs pull-requests: write for any sticky-comment behavior, and whether timeout-minutes: 2 and the default shallow checkout are still generous enough for a composite action. Those are the only two unknowns, and both are runtime properties of the pinned action rather than defects visible in the diff — worth a glance at the first green run, not a blocker.

📊 Overall: Like a fix PR that just fixes the thing and touches nothing else — a unicorn sighting in production. I'm keeping the receipt just in case the workflow, you know, actually runs.

Files Reviewed (1 file)

• .github/workflows/pr.yml — 0 issues

---

_{Reviewed by efficient · Input: 58.2K · Output: 7.6K · Cached: 243.6K}

[Copilot]

🔵 Needs a closer look

Access restrictions prevented verification of the pinned action’s behavior, required permissions, and runner-label support.

No open issues 🎉

What changed in this PR

Replaces standalone workflow linting with centralized PR validation, intended to support the Ubuntu 26.04 runner migration without local actionlint configuration.

Changes:

• Pins bcgov/actions/pr-validate to the specified v0.9.0 commit.
• Adds read-only pull-request permission to the lint job.

File	Description
.github/​workflows/​pr.yml	Adopts centralized validation and adds its pull-request read permission.

_{Review effort: Balanced}