Fix validate-workflows target: use Docker-based actionlint

[Copilot]

The make validate-workflows target failed with "actionlint: not found" because it invoked actionlint directly without proper setup.

Changes

Makefile (lines 333-337)

• Changed to use Docker-based actionlint via ./gh-aw compile --actionlint
• Added build dependency to ensure gh-aw binary exists
• Consistent with existing make actionlint target

Makefile help text (line 591)

• Updated to document build dependency
• Removed nonexistent validate target from help

Before

validate-workflows:
	@echo "Validating compiled workflow lock files..."
	actionlint .github/workflows/*.lock.yml; \

After

validate-workflows: build
	@echo "Validating compiled workflow lock files..."
	./$(BINARY_NAME) compile --actionlint

Benefits

1. No separate installation: Uses Docker-based actionlint (no need for make tools)
2. Consistency: Same Docker integration as make actionlint target
3. Cross-platform: Docker-based approach works everywhere
4. Simplicity: Clean 3-line implementation vs complex PATH setup
5. Up-to-date validation: Recompiles workflows before linting

This approach aligns with the project's architecture of using Docker for all external tools (actionlint, zizmor, poutine).

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[plan] Debug and fix actionlint compilation failures</issue_title>
<issue_description>## Objective

Investigate and resolve actionlint compilation failures to enable workflow linting during the static analysis process.

Context

The static analysis report indicates that actionlint compilation is failing. actionlint is a static checker for GitHub Actions workflow files that catches common mistakes and best practices violations.

Approach

Step 1: Reproduce the compilation failure

# Try to compile with actionlint
make build
# Check for actionlint-related errors

Step 2: Identify the root cause

Check for:

• Missing dependencies in go.mod
• Version conflicts
• Build tag issues
• Installation method problems

Step 3: Determine fix approach

Depending on the issue:

• Missing dependency: Add to go.mod and run go mod tidy
• Version conflict: Update to compatible versions
• Build configuration: Update Makefile or build scripts
• Installation issue: Use alternative installation method (e.g., download binary)

Step 4: Implement the fix

Example fixes:

# If it's a Go dependency issue:
go get github.com/rhysd/actionlint/cmd/actionlint@latest
go mod tidy

# Or if using binary installation:
# Update Makefile to download actionlint binary

Step 5: Test actionlint integration

# Verify actionlint works
actionlint --version

# Test on sample workflow
actionlint .github/workflows/*.yml

Step 6: Integrate into build process

# Ensure it's part of the build
make build
make lint

Files to Modify

• go.mod (if dependency issue)
• go.sum (if dependency issue)
• Makefile (if build process issue)
• pkg/cli/compile_command.go (if integration issue)

Acceptance Criteria

• Root cause of compilation failure identified
• Fix implemented and tested
• actionlint runs successfully on workflow files
• actionlint integrated into make build or make lint
• No actionlint-related errors in CI
• Documentation updated if installation method changed

Estimated Effort

2-4 hours
Related to #7992

AI generated by Plan Command for discussion #7983

Comments on the Issue (you are @copilot in this section)

• Fixes [plan] Debug and fix actionlint compilation failures #7995

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[pelikhan]

@copilot always use docker based actionlint or compile --actionlint

[Copilot]

@copilot always use docker based actionlint or compile --actionlint

Changed to use Docker-based actionlint via ./gh-aw compile --actionlint in commit 5385911. The validate-workflows target now uses the same Docker integration as the actionlint target, eliminating the need for separate binary installation.