build(deps): bump github.com/rhysd/actionlint from 1.7.4 to 1.7.6

[dependabot]

Bumps github.com/rhysd/actionlint from 1.7.4 to 1.7.6.

Release notes

Sourced from github.com/rhysd/actionlint's releases.

v1.7.6

• Using contexts at specific workflow keys is incorrectly reported as not allowed. Affected workflow keys are as follows. (#495, #497, #498, #500)
  • jobs.<job_id>.steps.with.args
  • jobs.<job_id>.steps.with.entrypoint
  • jobs.<job_id>.services.<service_id>.env
• Update Go dependencies to the latest.

v1.7.5

• Strictly check available contexts in ${{ }} placeholders following the 'Context availability' table in the official document.
  • For example, jobs.<job_id>.defaults.run.shell allows env context but shell workflow keys in other places allow no context.

    defaults:
      run:
        # ERROR: No context is available here
        shell: ${{ env.SHELL }}
    jobs:
    test:
    runs-on: ubuntu-latest
    defaults:
    run:
    # OK: 'env' context is available here
    shell: ${{ env.SHELL }}
    steps:
    - run: echo hello
    # ERROR: No context is available here
    shell: ${{ env.SHELL}}

• Check a string literal passed to fromJSON() call. This pattern is popular to create array or object constants because GitHub Actions does not provide the literal syntax for them. See the document for more details. (#464)

  jobs:
    test:
      # ERROR: Key 'mac' does not exist in the object returned by the fromJSON()
      runs-on: ${{ fromJSON('{"win":"windows-latest","linux":"ubuntul-latest"}')['mac'] }}
      steps:
        - run: echo This is a special branch!
          # ERROR: Broken JSON string passed to fromJSON.
          if: contains(fromJSON('["main","release","dev"'), github.ref_name)

• Allow passing command arguments to -shellcheck argument. (#483, thanks @​anuraaga)
  • This is useful when you want to use alternative build of shellcheck like go-shellcheck.

    actionlint -shellcheck="go run github.com/wasilibs/go-shellcheck/cmd/shellcheck@latest"

• Support undocumented repository_visibility, artifact_cache_size_limit, step_summary, output, state properties in github context. (#489, thanks @​rasa for adding repository_visibility property)
• Remove macos-12 runner label from known labels because it was dropped from GitHub-hosted runners on Dec. 3 and is no longer available.
• Add windows-2025 runner label to the known labels. The runner is in public preview. (#491, thanks @​ericcornelissen)
• Add black to the list of colors for branding.color action metadata. (#485, thanks @​eifinger)
• Add table to the list of icons for branding.icon action metadata.
• Fix parsing escaped { in format() function call's first argument.

... (truncated)

Changelog

Sourced from github.com/rhysd/actionlint's changelog.

v1.7.6 - 2025-01-04

• Using contexts at specific workflow keys is incorrectly reported as not allowed. Affected workflow keys are as follows. (#495, #497, #498, #500)
  • jobs.<job_id>.steps.with.args
  • jobs.<job_id>.steps.with.entrypoint
  • jobs.<job_id>.services.<service_id>.env
• Update Go dependencies to the latest.

[Changes][v1.7.6]

v1.7.5 - 2024-12-28

• Strictly check available contexts in ${{ }} placeholders following the 'Context availability' table in the official document.
  • For example, jobs.<job_id>.defaults.run.shell allows env context but shell workflow keys in other places allow no context.

    defaults:
      run:
        # ERROR: No context is available here
        shell: ${{ env.SHELL }}
    jobs:
    test:
    runs-on: ubuntu-latest
    defaults:
    run:
    # OK: 'env' context is available here
    shell: ${{ env.SHELL }}
    steps:
    - run: echo hello
    # ERROR: No context is available here
    shell: ${{ env.SHELL}}

• Check a string literal passed to fromJSON() call. This pattern is popular to create array or object constants because GitHub Actions does not provide the literal syntax for them. See the document for more details. (#464)

  jobs:
    test:
      # ERROR: Key 'mac' does not exist in the object returned by the fromJSON()
      runs-on: ${{ fromJSON('{"win":"windows-latest","linux":"ubuntul-latest"}')['mac'] }}
      steps:
        - run: echo This is a special branch!
          # ERROR: Broken JSON string passed to fromJSON.
          if: contains(fromJSON('["main","release","dev"'), github.ref_name)

• Allow passing command arguments to -shellcheck argument. (#483, thanks @​anuraaga)
  • This is useful when you want to use alternative build of shellcheck like go-shellcheck.

    actionlint -shellcheck="go run github.com/wasilibs/go-shellcheck/cmd/shellcheck@latest"

... (truncated)

Commits

• e54bba5 bump up version to v1.7.6
• d63ee9f update golang.org/x/sys to v0.29
• e494681 add tests for parsing command line passed to -shellcheck and -pyflakes
• 895f01a fix jobs.\<job_id>.services.\<service_id>.env should allow contexts (#500)
• 207b9aa fix CI badge and link in readme
• ac7fd16 Merge pull request #494 from szepeviktor/typos
• 1b58c1f fix no context is allowed at jobs.\<job_id>.steps.with.entrypoint`
• 331d6a9 fix available contexts are ignored at jobs.\<job_id>.with.args (fix #495)
• a65c160 Fix typos
• efd7eb5 update changelog for v1.7.5 changes
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)