ci: 💚 refactor GHA lint tools (#2421)

.github/dependabot.yml

@@ -1,13 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: github-actions
-    directory: "/"
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 10
-
-  - package-ecosystem: pip
-    directory: "/"
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 10

.github/renovate.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:best-practices",
+    "customManagers:githubActionsVersions",
+    ":automergeBranch",
+    ":automergeDigest",
+    ":automergeLinters",
+    ":automergeStableNonMajor",
+    ":automergeTesters",
+    ":automergeTypes",
+    ":enableVulnerabilityAlerts",
+    ":renovatePrefix"
+  ],
+  "baseBranches": ["$default"]
+}

.github/workflows/automatic-changelog.yml

@@ -13,8 +13,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout repository
+      - name: Checkout
-        uses: actions/checkout@v4.1.6
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
           token: ${{ secrets.PAT }}

.github/workflows/conflicts.yml

@@ -2,8 +2,6 @@ name: Label Conflicts
 
 on:
   push:
-    branches:
-      - master
   pull_request:
 
 jobs:
@@ -12,7 +10,9 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: mschilde/auto-label-merge-conflicts@master
+      - name: Label merge conflicts
+        uses: mschilde/auto-label-merge-conflicts@v2.0
+        if: github.event.repository.fork == false
         with:
           CONFLICT_LABEL_NAME: "Status: Conflicted"
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/custom-format-validation.yml

@@ -2,8 +2,6 @@ name: Validate Custom Format JSONs
 
 on:
   push:
-    branches:
-      - master
     paths:
       - .github/workflows/custom-format-validation.yml
       - docs/json/guide-only/*.json
@@ -23,10 +21,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout repository
+      - name: Checkout
-        uses: actions/checkout@v4.1.5
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Setup Python
+      - name: Setup python
         uses: actions/setup-python@v5.6.0
         with:
           python-version: "3.x"

.github/workflows/deploy-pr.yml

@@ -25,8 +25,8 @@ jobs:
       pr_number: ${{ steps.pr_info.outputs.pr_number }}
       pr_sha: ${{ steps.pr_info.outputs.pr_sha }}
     steps:
-      - name: 'Download artifact'
+      - name: Download artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v4.3.0
         with:
           run-id: ${{ github.event.workflow_run.id }}
           github-token: ${{ github.token }}
@@ -42,8 +42,8 @@ jobs:
           echo "pr_number=$(cat ${{ github.workspace }}/pr_info/PR_NUMBER)" >> $GITHUB_OUTPUT
           echo "pr_sha=$(cat ${{ github.workspace }}/pr_info/PR_SHA)" >> $GITHUB_OUTPUT
 
-      - name: Checkout repo
+      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ steps.pr_info.outputs.pr_sha }}
           fetch-depth: 0
@@ -81,7 +81,7 @@ jobs:
 
       - name: Publish to Cloudflare Pages
         id: cloudflare
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v3.1.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
           accountId: ${{ secrets.CF_ACCOUNT_ID }}
@@ -96,8 +96,8 @@ jobs:
     runs-on: ubuntu-latest
     if: always() && github.event.repository.fork == false
     steps:
-      - name: Checkout repo
+      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Comment PR
         run: |

.github/workflows/deploy.yml

@@ -2,8 +2,6 @@ name: Build and Deploy Docs
 
 on:
   push:
-    branches:
-      - master
 
 jobs:
   build:
@@ -13,8 +11,8 @@ jobs:
       group: ${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: true
     steps:
-      - name: Checkout repository
+      - name: Checkout
-        uses: actions/checkout@v4.1.6
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
           sparse-checkout: |
@@ -50,14 +48,14 @@ jobs:
           mkdocs --version
 
       - name: Publish to Cloudflare Pages
-        if: github.event_name == 'push' && contains(fromJson('["refs/heads/master", "refs/heads/main"]'), github.ref)
+        if: github.event_name == 'push' && github.event.repository.fork == false
         id: cloudflare
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v3.1.0
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
           accountId: ${{ secrets.CF_ACCOUNT_ID }}
           command: >
             pages deploy site
             --project-name=trash-guides
-            --branch=master
+            --branch=${{ github.ref_name }}
             --commit-hash=${{ github.sha }}

.github/workflows/labeler.yml

@@ -2,8 +2,6 @@ name: Label Pull Requests
 
 on:
   push:
-    branches:
-      - master
   pull_request_target:
 
 jobs:
@@ -13,6 +11,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v5
+      - name: Labeler
+        uses: actions/labeler@v5.0.0
         with:
           sync-labels: true

.github/workflows/lint-editor.yml

@@ -1,18 +0,0 @@
-name: Lint - EditorConfig
-
-on:
-  push:
-    branches:
-      - master
-  pull_request:
-
-jobs:
-  editorconfig-checker:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.1.6
-      - name: editorconfig-checker
-        run: |
-          docker run --rm \
-            -v "${GITHUB_WORKSPACE}":/check \
-            mstruebing/editorconfig-checker

.github/workflows/lint-markdown.yml

@@ -1,21 +0,0 @@
-name: Lint - Markdown
-
-on:
-  push:
-    branches:
-      - master
-  pull_request:
-
-jobs:
-  markdownlint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.1.6
-      - name: markdownlint
-        # markdownlint-cli pinned to v0.45.0
-        run: |
-          docker run --rm \
-            -v "${GITHUB_WORKSPACE}":/workdir \
-            ghcr.io/igorshubovych/markdownlint-cli@sha256:27eadb7b23b79b4b01b9220e18467d041804e632f41cf69b9c1613b48ed72749 \
-            -c "/workdir/.markdownlint.yaml" \
-            .

.github/workflows/lint-yaml.yml

@@ -1,23 +0,0 @@
-name: Lint - YAML
-
-on:
-  push:
-    branches:
-      - master
-  pull_request:
-
-jobs:
-  yamllint:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4.1.6
-
-      - name: Run yamllint
-        run: |
-          docker run --rm \
-            -v "${GITHUB_WORKSPACE}":/yaml \
-            peterdavehello/yamllint \
-            yamllint \
-            -c "/yaml/yamllint.yml" \
-            .

.github/workflows/lint.yml

@@ -0,0 +1,39 @@
+name: Lint
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  editorconfig-checker:
+    runs-on: ubuntu-latest
+    container:
+      image: mstruebing/editorconfig-checker:v3.3.0@sha256:a04d1bf7c8c7e01534e11ce9253d66721d7b039722ce514910c59bb68ce14f50
+      options: --user 0:0
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: editorconfig-checker
+        run: editorconfig-checker .
+
+  markdownlint:
+    runs-on: ubuntu-latest
+    container:
+      image: davidanson/markdownlint-cli2:v0.18.1@sha256:173cb697a255a8a985f2c6a83b4f7a8b3c98f4fb382c71c45f1c52e4d4fed63a
+      options: --user 0:0
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: markdownlint
+        run: markdownlint-cli2 **.{md,markdown}
+
+  yamllint:
+    runs-on: ubuntu-latest
+    container:
+      image: peterdavehello/yamllint:1.37.0@sha256:bb8e9a2970f31503714447e2c309add8eb27ad57a66dee6fa2d37322415ed0ae
+      options: --user 0:0
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: yamllint
+        run: yamllint .

.github/workflows/metadata-validation.yml

@@ -2,8 +2,6 @@ name: Validate Metadata JSON
 
 on:
   push:
-    branches:
-      - master
     paths:
       - metadata.json
       - metadata.schema.json
@@ -19,8 +17,10 @@ jobs:
     runs-on: ubuntu-latest
     name: Validate metadata.json
     steps:
-      - uses: actions/checkout@v4.1.6
+      - name: Checkout
-      - uses: actions/setup-python@v5.6.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Setup python
+        uses: actions/setup-python@v5.6.0
         with:
           python-version: 3.x
       - run: pip install jsonschema

.github/workflows/mkdocs_bug_prevent.yml

@@ -2,8 +2,6 @@ name: Check for Mkdocs Issues
 
 on:
   push:
-    branches:
-      - master
   pull_request:
 
 jobs:
@@ -13,8 +11,8 @@ jobs:
       pull-requests: write
 
     steps:
-      - name: Checkout Code
+      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Find JSON Files Changed in Commit
         id: find_json_files

.github/workflows/pr-naming-check.yml

@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Validate Pull Request Title
         id: check_title
-        uses: actions/github-script@v7
+        uses: actions/github-script@v7.0.1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/trigger-pr-deploy.yml

@@ -22,7 +22,8 @@ jobs:
           echo ${{ github.event.pull_request.number }} > ./pr_info/PR_NUMBER
           echo ${{ github.event.pull_request.head.sha }} > ./pr_info/PR_SHA
 
-      - uses: actions/upload-artifact@v4
+      - name: Upload PR info
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: pr_info
           path: pr_info/

.github/workflows/update_contributors.yml

@@ -2,8 +2,6 @@ name: Update contributors
 
 on:
   push:
-    branches:
-      - master
 
 permissions:
   contents: write
@@ -14,12 +12,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           token: ${{ secrets.PAT }}
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v4.4.0
         with:
           node-version: "20"