From 352c630bec88fad50eb3898485cd5df7fcc20233 Mon Sep 17 00:00:00 2001
From: Jacob Repp <jacobrepp@gmail.com>
Date: Wed, 9 Sep 2026 02:54:37 -0700
Subject: [PATCH 1/2] ci: lint GitHub Actions workflows with actionlint

Validate ci.yml, pages.yml, and release.yml on every push and pull
request. Downloads the pinned actionlint v1.7.12 binary and verifies its
sha256 checksum.
---
 .github/workflows/ci.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b4d5769..46782e5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -263,3 +263,20 @@ jobs:
 
       - name: Run dependency security regression tests
         run: npm run test:security
+
+  workflow-lint:
+    name: Lint GitHub Actions workflows
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+
+      - name: Download actionlint
+        run: |
+          curl -sSL -o actionlint.tar.gz https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz
+          echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  actionlint.tar.gz" | sha256sum -c -
+
+      - name: Run actionlint
+        run: |
+          tar -xzf actionlint.tar.gz
+          ./actionlint

From 95639c38e20859f88d72b09e0f117a57b5fdfe37 Mon Sep 17 00:00:00 2001
From: Jacob Repp <jacobrepp@gmail.com>
Date: Wed, 9 Sep 2026 02:59:01 -0700
Subject: [PATCH 2/2] ci(release): fix shellcheck and deprecated action issues

Resolve issues surfaced by actionlint in release.yml:
- Quote $GITHUB_ENV and $GITHUB_OUTPUT (SC2086)
- Use ./* glob for zip (SC2035)
- Bump softprops/action-gh-release to v3.0.3 (v1 runner too old)
---
 .github/workflows/release.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 48d237d..24d736b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,11 +54,11 @@ jobs:
           if [ "${{ matrix.compiler }}" = "clang" ]; then
             sudo apt-get update
             sudo apt-get install -y clang
-            echo "CC=clang" >> $GITHUB_ENV
-            echo "CXX=clang++" >> $GITHUB_ENV
+            echo "CC=clang" >> "$GITHUB_ENV"
+            echo "CXX=clang++" >> "$GITHUB_ENV"
           else
-            echo "CC=gcc" >> $GITHUB_ENV
-            echo "CXX=g++" >> $GITHUB_ENV
+            echo "CC=gcc" >> "$GITHUB_ENV"
+            echo "CXX=g++" >> "$GITHUB_ENV"
           fi
 
       - name: Configure CMake
@@ -139,7 +139,7 @@ jobs:
           find artifacts/linux-packages-* -type f \( -name "*.deb" -o -name "*.rpm" -o -name "*.tar.gz" \) -exec cp {} release/ \;
           # Copy WASM module
           cd artifacts/wasm-module
-          zip -r ../../release/ipv6-parse-wasm.zip *
+          zip -r ../../release/ipv6-parse-wasm.zip ./*
           cd ../..
 
       - name: Extract version from tag
@@ -151,8 +151,8 @@ jobs:
             TAG="${{ github.ref_name }}"
           fi
           VERSION=${TAG#v}
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "tag=$TAG" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
       - name: Generate release notes
         run: |
@@ -198,7 +198,7 @@ jobs:
           EOF
 
       - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3.0.3
         with:
           tag_name: ${{ steps.version.outputs.tag }}
           name: Release ${{ steps.version.outputs.version }}
@@ -286,7 +286,7 @@ jobs:
         run: |
           TAG="${{ github.ref_name }}"
           VERSION=${TAG#v}
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Create Conan package
         run: |