[#1052 D] Baseline hygiene: actionlint + pr-review startup_failure canary (blocked on #1253)

[don-petry]

Split 4 of 4 of #1052 (channel-skew prevention). Part D — baseline hygiene: actionlint + pr-review startup_failure canary.

Blocked on Parts A/B (#1253): this part also edits .github/workflows/lint.yml (adds the actionlint job). Implement it after #1253 (and Part B) merge so it rebases cleanly. The dev-lead label is withheld until then.

Deliverable

• Add actionlint (SHA-pinned) to lint.yml for general workflow linting. Note it does NOT catch the pinned-remote-ref skew (actionlint only input-checks local ./ reusable refs) — Part A is still required; call this out in a comment so it isn't mistaken for coverage.
• Add a lightweight dry-run pr-review-trigger canary (scheduled and/or post-merge on main, .github/workflows/pr-review-canary.yml + scripts/pr_review_canary.sh + tests/pr_review_canary.bats): dispatch with dry_run=true and fail loud if the run ends in startup_failure — turning silent post-merge breakage into a gating signal (the manual dry-run used to verify fix(pr-review): unbreak reviews — stub must not forward lsp_pilot_variant to the pinned channel #1048's recovery).

Acceptance

• actionlint runs in CI; canary fails loud on startup_failure. shellcheck clean; existing suites green. Additive; new actions SHA-pinned.

Parent: #1052.

[don-petry]

Released. Part B (#1255) merged in PR #1268 at 11:24Z — its lint.yml stub-freeze job is now on main. This Part D (actionlint + pr-review startup_failure canary) rebases cleanly on top. Flipped dev-lead:hands-off → dev-lead. This is the last piece of epic #1052.

[don-petry]

Dev-Lead Implementation Plan

Issue: #1256 — [#1052 D] Baseline hygiene: actionlint + pr-review startup_failure canary (blocked on #1253)

Scope

Add actionlint (checksum-pinned, mirroring the vetted ci.yml install) to lint.yml for general workflow linting, plus a lightweight dry-run pr-review-trigger canary that fails loud when the dispatched run ends in startup_failure — turning silent post-merge channel-skew (#1034 class) breakage into a gating signal.

Blocker status: #1253 (validate-caller-inputs) and Part B #1255 (caller-stub-freeze) are both merged and present in lint.yml, so this part rebases cleanly.

Implementation Checklist

• .github/workflows/lint.yml — add actionlint job (checksum-pinned gh release download, same v1.7.12 as ci.yml), with a comment that it does not catch the pinned-remote-ref channel skew (Part A / validate-caller-inputs is still required)
• scripts/pr_review_canary.sh — dry-run dispatch of pr-review-trigger.yml, poll for the run, classify startup_failure → fail loud (pure helpers mirror scripts/initiative_canary.sh)
• .github/workflows/pr-review-canary.yml — scheduled (off-peak) + post-merge-on-main + workflow_dispatch; alerts via the shared canary tracking-issue pattern
• .github/workflows/lint.yml — register tests/pr_review_canary.bats in the bats job list
• AGENTS.md — add the repo-specific-workflow exception entry for pr-review-canary.yml

Tests to Write

• tests/pr_review_canary.bats — classify_canary_run (startup_failure→STARTUP_FAILURE, success→OK, failure/timed_out→FAILED, ""/null→NO_RUN); canary_is_failure; canary_report; mocked-gh main() asserting dry-run dispatch + fail-loud on startup_failure + command-injection guard

Test Command

scripts/run-bats.sh tests/pr_review_canary.bats (full suite via the bats job list); bash .dev-lead/scripts/dev-lead-lint.sh

[don-petry]

Dev-Lead: Implementation Complete

Plan Execution

• Added actionlint job to .github/workflows/lint.yml — checksum-pinned install (v1.7.12, sha256) via gh release download, matching the vetted ci.yml step; no unpinned marketplace action
• Added a comment on the actionlint job stating it does not catch the pinned-remote-ref channel skew (actionlint only input-checks local ./ reusable refs) — validate-caller-inputs (Part A [#1052 A] CI guard: forwarded caller inputs ⊆ declared inputs at the pinned @ref (+ #1034 regression) #1253) / caller-stub-freeze (Part B [#1052 B] Stub-freeze drift guard for ring-0 caller stubs (blocked on #1253) #1255) remain required
• Added scripts/pr_review_canary.sh — dry-run dispatch of pr-review-trigger.yml, polls the run, fails loud on startup_failure (the feat: implement issue #1031 — fix(#844): plumb LSP_PILOT_ENABLED env + decouple capture from LSP wiring so the pilot A/B runs in CI #1034 channel-skew fingerprint) or any non-success
• Added .github/workflows/pr-review-canary.yml — daily off-peak cron (50 6 * * *) + post-merge push on main (pr-review stub/reusable paths) + workflow_dispatch; alerts via the shared canary tracking-issue pattern; guarded on GH_PAT_WORKFLOWS
• Registered tests/pr_review_canary.bats in the bats job list in lint.yml
• Documented the repo-specific-workflow exception for pr-review-canary.yml in AGENTS.md

Test Results

# scripts/run-bats.sh (canary + drift-guard subset) — 187/187 ok, incl:
ok 174 classify_canary_run: a startup_failure conclusion is STARTUP_FAILURE
ok 175 classify_canary_run: success is OK
ok 182 canary_report: OK report names the pr-review-trigger path
ok 183 canary_report: the startup_failure status surfaces the channel-skew hint
ok 184 main: dispatches pr-review-trigger in DRY-RUN and exits OK on a clean run
ok 185 main: a startup_failure run sets CANARY_FAILED and exits non-zero
ok 186 main: a plain failing run sets CANARY_FAILED and exits non-zero
ok 187 main: exits with error when GH_TOKEN is unset (dispatch would never start a run)

# shellcheck --severity=warning -x scripts/pr_review_canary.sh   → PASS
# bash .dev-lead/scripts/dev-lead-lint.sh                         → all checks passed
# actionlint (v1.7.12) over all non-lock workflows               → CLEAN
# bash scripts/validate-workflow-schedules.sh                    → OK (no minute-0 crons)

Files Changed

• .github/workflows/lint.yml: new actionlint job (checksum-pinned) + tests/pr_review_canary.bats registered in the bats job
• .github/workflows/pr-review-canary.yml (new): dry-run pr-review-trigger canary, fail-loud on startup_failure
• scripts/pr_review_canary.sh (new): pure classify/report helpers + main() dispatch/poll (mirrors scripts/initiative_canary.sh)
• tests/pr_review_canary.bats (new): 14 unit tests (classify / alert / report / mocked-gh main())
• AGENTS.md: repo-specific-workflow exception entry for pr-review-canary.yml

Notes

• The canary is intentionally DRY-RUN (dry_run=true) so the dispatched pr-review reusable submits no reviews/comments — it changes nothing.
• The dispatch requires GH_PAT_WORKFLOWS; a workflow_dispatch fired with GITHUB_TOKEN never starts a run (loop prevention). The workflow skips gracefully with a ::warning:: if the PAT is unset, matching the other repo canaries.
• Blockers cleared: validate-caller-inputs ([#1052 A] CI guard: forwarded caller inputs ⊆ declared inputs at the pinned @ref (+ #1034 regression) #1253) and caller-stub-freeze ([#1052 B] Stub-freeze drift guard for ring-0 caller stubs (blocked on #1253) #1255) are both merged and present in lint.yml, so Part D rebased cleanly.
• actionlint also runs in ci.yml; this adds it to lint.yml as the issue specifies. The install is kept byte-for-byte in lockstep (same version + checksum) so the two never drift.
• Additive only; no existing behavior changed. New tooling is checksum-pinned (no new unpinned uses: actions).