From 774199411b55c7c4fa49e6925a3a012105a15de1 Mon Sep 17 00:00:00 2001
From: swibrow <15628653+swibrow@users.noreply.github.com>
Date: Fri, 7 Aug 2026 07:24:55 +0200
Subject: [PATCH] feat(actions-runner): bake actionlint into the mise toolchain

home-ops' new "checks" workflow lints every workflow file with actionlint
on every PR; fetching+checksum-verifying the binary fresh each run is
exactly the per-repo drift this image exists to absorb. Add it to
mise.toml alongside hadolint/shellcheck (same static-binary, workflow
tooling category) and bump the revision so IfNotPresent-pulling scale
sets pick up the new tag.

Signed-off-by: swibrow <15628653+swibrow@users.noreply.github.com>
---
 images/actions-runner/metadata.yaml | 2 +-
 images/actions-runner/mise.toml     | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/images/actions-runner/metadata.yaml b/images/actions-runner/metadata.yaml
index 2e2b514..52b6c0e 100644
--- a/images/actions-runner/metadata.yaml
+++ b/images/actions-runner/metadata.yaml
@@ -7,7 +7,7 @@ description: GitHub Actions runner for Actions Runner Controller, with docker CL
 # tracks upstream on RUNNER_VERSION in the Dockerfile — deliberately not
 # annotated here, since a -N suffix is a semver pre-release and would be
 # "upgraded" straight back to the bare release.
-version: 2.336.0-3
+version: 2.336.0-4
 platforms:
   - linux/amd64
   - linux/arm64
diff --git a/images/actions-runner/mise.toml b/images/actions-runner/mise.toml
index ef9d340..6d716bf 100644
--- a/images/actions-runner/mise.toml
+++ b/images/actions-runner/mise.toml
@@ -6,6 +6,7 @@
 # pins against (language runtimes, kubectl, helm) stays out and is left to the
 # setup-* actions, which cache into RUNNER_TOOL_CACHE.
 [tools]
+actionlint = "1.7.12"
 gh = "2.96.0"
 hadolint = "2.14.0"
 shellcheck = "0.11.0"