fix(ci): remove unsupported concurrency queue key and lint workflows

[konard]

Summary

Fixes #62.

release.yml carried queue: max inside the two write-capable concurrency:
blocks. The syntax
defines exactly two keys, group and cancel-in-progress, so GitHub ignored
queue silently — the file documented a queuing guarantee it never had. The
same fix already landed in the Rust (#113)
and JS (#117)
templates; the Python template missed that sweep.

Effective behaviour is unchanged: with cancel-in-progress: false a started
write is never interrupted and GitHub holds one pending run per group. That is
now what the comment above jobs: says.

How to reproduce

actionlint does report the key — contrary to the issue's note, which assumed
it did not. That is precisely why the second half of this PR matters: nothing
in the repository ran actionlint, so nobody saw the message.

$ actionlint -no-color -oneline .github/workflows/*.yml
.github/workflows/release.yml:492:7: unexpected key "queue" for "concurrency" section. expected one of "cancel-in-progress", "group" [syntax-check]
.github/workflows/release.yml:541:9: shellcheck reported issue in this script: SC2086:info:6:44: Double quote to prevent globbing and word splitting [shellcheck]
.github/workflows/release.yml:541:9: shellcheck reported issue in this script: SC2086:info:18:34: Double quote to prevent globbing and word splitting [shellcheck]
.github/workflows/release.yml:541:9: shellcheck reported issue in this script: SC2086:info:21:33: Double quote to prevent globbing and word splitting [shellcheck]
.github/workflows/release.yml:606:7: unexpected key "queue" for "concurrency" section. expected one of "cancel-in-progress", "group" [syntax-check]
.github/workflows/release.yml:760:9: shellcheck reported issue in this script: SC2129:style:8:3: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
.github/workflows/release.yml:859:9: shellcheck reported issue in this script: SC2046:warning:4:3: Quote this to prevent word splitting [shellcheck]

After this PR the same command exits 0 with no output.

Changes

• release.yml — dropped queue: max from both concurrency: blocks and
  rewrote the header comment to describe the behaviour the file actually has.
• release.yml — cleared every shellcheck finding: quoted the three
  >> "$GITHUB_OUTPUT" redirections (SC2086), grouped the Docker publish
  config writes into one redirect (SC2129), and marked the manifest-digest
  expansion # shellcheck disable=SC2046 with a note that the word splitting
  is deliberate (SC2046). The printf format reuse there is unchanged.
• .github/workflows/workflows.yml (new) — runs actionlint on any change
  under .github/, via docker://rhysd/actionlint:1.7.7 so shellcheck and
  pyflakes lint every run: block too. A native binary without shellcheck
  on PATH skips the shell checks and still exits 0, which is worth knowing
  before reproducing a finding locally.

Tests

Three tests in tests/test_workflows.py, all failing before the fix:

• test_workflow_concurrency_blocks_use_only_supported_keys scans every
  workflow and rejects any concurrency key outside {group, cancel-in-progress}.
  Re-adding queue: max makes it fail with
  release.yml: concurrency blocks declare ['queue'], which GitHub Actions ignores silently — verified.
• test_concurrency_key_parser_reports_unsupported_keys pins the parser itself
  against a fixture, so the scanner above cannot pass by finding nothing.
• test_workflow_lint_job_validates_every_workflow keeps the actionlint job in
  place, pinned to the Docker image rather than a bare binary.
• test_release_workflow_separates_check_and_write_concurrency updated to the
  expected block without the removed key.

Local checks: pytest (88 passed), ruff check, ruff format --check,
mypy src/, scripts/check_file_size.py, scripts/validate_changeset.py, and
actionlint with shellcheck on PATH — all clean.

A changelog fragment is included, which is the release trigger for this repo.

[konard]

Working session summary

All four workflow runs on the branch head passed. The work is done.

PR: #63 (ready for review, working tree clean, main already merged in)

What was wrong

release.yml had queue: max inside the two write-capable concurrency: blocks (lines 492 and 606). GitHub Actions' concurrency syntax accepts only group and cancel-in-progress, so the key did nothing — the file documented a queuing guarantee it never had. The same fix already landed in the Rust and JS templates; the Python template missed the sweep.

Root cause of why it survived

The issue speculated that actionlint doesn't flag unknown concurrency keys. It does — I ran actionlint 1.7.7 with shellcheck on PATH and it reported the key explicitly:

release.yml:492:7: unexpected key "queue" for "concurrency" section. expected one of "cancel-in-progress", "group" [syntax-check]

The real cause is that nothing in the repository ever ran actionlint. That's the more useful half of the fix.

Changes

• release.yml — removed queue: max from both blocks; rewrote the header comment to describe the behaviour the file actually has (a started write is never interrupted; GitHub holds one pending run per group).
• release.yml — cleared every shellcheck finding the issue listed: quoted three >> "$GITHUB_OUTPUT" redirections (SC2086), grouped the Docker publish config writes into one redirect (SC2129), and annotated the manifest-digest expansion # shellcheck disable=SC2046 explaining that the word splitting is deliberate. The printf format-reuse semantics there are unchanged — I tried rewriting it and caught that it would have silently corrupted the digest arguments.
• .github/workflows/workflows.yml (new) — runs actionlint on any change under .github/, pinned to docker://rhysd/actionlint:1.7.7 so shellcheck lints every run: block. A native binary without shellcheck on PATH skips the shell checks and still exits 0.

Verification

Three new tests in tests/test_workflows.py, plus the updated existing one. I confirmed the scanner actually fails on the bug by re-adding queue: max — it reports release.yml: concurrency blocks declare ['queue'], which GitHub Actions ignores silently. A separate test pins the parser against a fixture so the scanner can't pass by finding nothing.

Local: pytest (88 passed), ruff check, ruff format --check, mypy src/, check_file_size.py, validate_changeset.py, and actionlint — all clean. A changelog fragment is included, which is this repo's release trigger.

One process note: partway through I ran git checkout .github/workflows/release.yml to undo a temporary mutation test and wiped my uncommitted edits to that file. I reapplied them and verified the final diff line by line.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost: $2.216187

📊 Context and tokens usage:

• 74.1K / 1M (7%) input tokens, 16.1K / 128K (13%) output tokens

Total: (92 new + 59.9K cache writes + 2.4M cache reads) input tokens, 16.1K output tokens, $2.216187 cost

🤖 Models used:

• Tool: Anthropic Claude Code
• Requested: opus (claude-opus-5)
• Thinking level: off (disabled)
• Model: Claude Opus 5 (claude-opus-5)

📎 Log file uploaded as Gist (1183KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

• All CI checks have passed

---

Auto-merged by hive-mind with --auto-merge flag