[chicks-net]

Done

• 🛠️ [gha] migrate actionlint from Docker Hub image to official download script (Migrate actionlint workflows from Docker Hub image to official download script (fix Docker Hub rate-limit failures) template-repo#399)

Meta

(Automated in .just/gh-process.just.)

[claude]

Review

Solid migration overall. SHA-pinning the script, pinning tool versions in env, harden-runner in block mode with an allowlist, and persist-credentials: false are all good practice.

Potential issues

1. Egress block mode is the main risk. I can't confirm the allowlist is complete without a run. pipx may reach other hosts, and release downloads have redirected via objects.githubusercontent.com as well as release-assets.githubusercontent.com. Check that CI on this PR is green. Running once in audit mode and comparing the insights to the list would be a safety net.
2. Checksum verification is only partial protection. The checksums come from the same release as the tarball, so this guards against transport or CDN corruption, not a compromised release (the comment says so). The step also re-downloads the tarball and overwrites the binary the script already installed, so the script's own install is effectively unused. Doing download, verify and extract in one step would drop the script, the raw.githubusercontent.com egress entry, and the SHA Renovate can't track.
3. linux_amd64 is hard-coded. Fine on ubuntu-latest today, but it breaks on ARM runners.
4. Binary location. The script writes into the current directory, which is the workspace. Harmless here, but worth remembering if later steps are added.

Minor

• renovate.json has a bridgecrewio/checkov-action git-refs override. I don't see a checkov workflow in this PR, so it looks like template carry-over. Drop it if this repo doesn't use that action.
• minimumReleaseAge appears in two package rules. That's fine, but the second only matters for the two custom deps.
• The problem matcher regex handles the ANSI codes from -color. Make sure the relative ::add-matcher:: path resolves from the workspace.

CLAUDE.md: this repo should rarely get PRs, but these are standard template-synced files, so the change seems appropriate.

Tests: none, as expected for CI config. The PR's own actionlint run is the real test.

🤖 Generated with Claude Code