From 1af5b1b7ea78070f9577ca8a6a8b5119d7164cca Mon Sep 17 00:00:00 2001
From: Tsvika Shapira <tsvika@moonmath.ai>
Date: Sun, 27 Sep 2026 14:40:45 +0300
Subject: [PATCH 1/2] ci: switch actionlint to the kjanat fork; use $/ for the
 local workflow

rhysd/actionlint has not released since 2026-03 and rejects GitHub's
self-repository `uses: $/...` syntax (rhysd/actionlint#711), which
zizmor 1.30's self-repository audit requires. kjanat/actionlint is a
maintained drop-in fork (rhysd/actionlint#719) that accepts it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GyMoD8tx4oz1bpJ1tEL845
---
 .pre-commit-config.yaml                                      | 5 +++--
 .../{% if in_pypi %}build-and-publish.yml{% endif %}.jinja   | 2 +-
 project_name/.pre-commit-config.yaml.jinja                   | 3 ++-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 46d0534..11bec8c 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -145,8 +145,9 @@ repos:
       - id: check-github-actions
       - id: check-github-workflows
       - id: check-readthedocs
-  - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.12
+  # Maintained fork of rhysd/actionlint (inactive since 2026-04), supports `uses: $/`
+  - repo: https://github.com/kjanat/actionlint
+    rev: v1.17.0
     hooks:
       - id: actionlint
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
diff --git a/project_name/.github/workflows/{% if in_pypi %}build-and-publish.yml{% endif %}.jinja b/project_name/.github/workflows/{% if in_pypi %}build-and-publish.yml{% endif %}.jinja
index f146bfa..da84c6d 100644
--- a/project_name/.github/workflows/{% if in_pypi %}build-and-publish.yml{% endif %}.jinja	
+++ b/project_name/.github/workflows/{% if in_pypi %}build-and-publish.yml{% endif %}.jinja	
@@ -24,7 +24,7 @@ env:
 
 jobs:
   ci:
-    uses: ./.github/workflows/ci.yml
+    uses: $/.github/workflows/ci.yml
 
   build-and-inspect-package:
     needs: ci
diff --git a/project_name/.pre-commit-config.yaml.jinja b/project_name/.pre-commit-config.yaml.jinja
index 126c21d..cdaaa02 100644
--- a/project_name/.pre-commit-config.yaml.jinja
+++ b/project_name/.pre-commit-config.yaml.jinja
@@ -214,7 +214,8 @@ repos:
       - id: check-github-actions
       - id: check-github-workflows
       - id: check-readthedocs
-  - repo: https://github.com/rhysd/actionlint
+  # Maintained fork of rhysd/actionlint (inactive since 2026-04), supports `uses: $/`
+  - repo: https://github.com/kjanat/actionlint
     rev: <placeholder_until_update_deps>
     hooks:
       - id: actionlint

From 7db1cbfac2ac17a479b6fd9fd350226eb628f269 Mon Sep 17 00:00:00 2001
From: Tsvika Shapira <tsvika@moonmath.ai>
Date: Sun, 27 Sep 2026 14:56:51 +0300
Subject: [PATCH 2/2] ci: make prek auto-update take exact kjanat/actionlint
 releases

The fork points minor tags (v1.17) at off-branch commits made for its
Docker action, and prek picks them as the newest tag. pre-commit ignores
the `update:` key with a warning, and its autoupdate already only takes
tags reachable from the default branch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GyMoD8tx4oz1bpJ1tEL845
---
 .pre-commit-config.yaml                    | 8 ++++++++
 project_name/.pre-commit-config.yaml.jinja | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 11bec8c..16f7765 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,5 +1,13 @@
 exclude: ^.cruft.json|.copier-answers.yml$
 
+# prek auto-update config (pre-commit warns about this key, and ignores it)
+update:
+  repos:
+    # the fork also moves minor tags (v1.17) to off-branch commits for its Docker
+    # action; only take exact releases
+    https://github.com/kjanat/actionlint:
+      include_tags: "v*.*.*"
+
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
diff --git a/project_name/.pre-commit-config.yaml.jinja b/project_name/.pre-commit-config.yaml.jinja
index cdaaa02..59c6207 100644
--- a/project_name/.pre-commit-config.yaml.jinja
+++ b/project_name/.pre-commit-config.yaml.jinja
@@ -11,6 +11,14 @@ ci:
   autofix_commit_msg: '[pre-commit.ci] 🎨 pre-commit fixes'
   autoupdate_schedule: quarterly
 
+# prek auto-update config (pre-commit warns about this key, and ignores it)
+update:
+  repos:
+    # the fork also moves minor tags (v1.17) to off-branch commits for its Docker
+    # action; only take exact releases
+    https://github.com/kjanat/actionlint:
+      include_tags: "v*.*.*"
+
 repos:
   # Sync Python and pre-commit package versions
   # pyproject.toml -> uv.lock