Add actionlint pre-commit hook for workflow validation

- Fix workflow to use github.* context vars (Forgejo schema validator
  only recognizes GitHub Actions syntax, not gitea.* aliases)
- Pass untrusted inputs through env vars (security best practice)
- Add actionlint to Brewfile and pre-commit config

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.forgejo/workflows/test.yaml

@@ -13,17 +13,21 @@ jobs:
       - name: Checkout (git clone)
         run: |
           # For PRs use head_ref (branch name), for pushes use ref_name
-          BRANCH="${{ gitea.head_ref || gitea.ref_name }}"
+          BRANCH="${HEAD_REF:-$REF_NAME}"
           git clone --depth 1 --branch "$BRANCH" \
-            "${{ gitea.server_url }}/${{ gitea.repository }}.git" .
+            "${SERVER_URL}/${REPOSITORY}.git" .
         env:
           GIT_SSL_NO_VERIFY: "true"
+          HEAD_REF: ${{ github.head_ref }}
+          REF_NAME: ${{ github.ref_name }}
+          SERVER_URL: ${{ github.server_url }}
+          REPOSITORY: ${{ github.repository }}
 
       - name: Hello World
         run: |
           echo "Hello from Forgejo Actions!"
           echo "Runner: $(hostname)"
-          echo "Repository: ${{ gitea.repository }}"
+          echo "Repository: ${{ github.repository }}"
-          echo "Event: ${{ gitea.event_name }}"
+          echo "Event: ${{ github.event_name }}"
-          echo "Ref: ${{ gitea.ref }}"
+          echo "Ref: ${{ github.ref }}"
           ls -la

.pre-commit-config.yaml

@@ -80,3 +80,10 @@ repos:
       - id: prettier
         types_or: [json]
         args: ['--tab-width', '2']
+
+  # GitHub/Forgejo Actions workflow linting
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.10
+    hooks:
+      - id: actionlint-system
+        files: ^\.forgejo/workflows/

Brewfile

@@ -1,4 +1,5 @@
 # CLI tools for blumeops management
+brew "actionlint"  # GitHub/Forgejo Actions workflow linter
 brew "argocd"  # ArgoCD CLI for GitOps management
 brew "bat"  # Syntax-highlighted file concatenation
 brew "tea"  # Gitea/Forgejo CLI for forge.tail8d86e.ts.net