ci: lint workflows and test the PR check's key-sharing decision

[scott-lowe-vapi]

Value

V.A.L.U.E. tier: small — touches .github/workflows/ (a blast-radius path) and the logic deciding which PRs receive the repository's Vapi keys.

• Problem: the PR check workflow decides, in a few lines of bash, whether a pull request runs live (with the repository's Vapi keys) or as a keyless dry run. That decision had no test, and no workflow in this repo had ever been linted. A mistake there either leaks keys to fork or Dependabot PRs, or silently turns every check into a dry run.
• Who it affects: every repo that enables PR checks, and the orgs whose keys are stored in it.
• What changes:
  • New tests/vapi-checks-workflow.test.ts runs the workflow's real steps, read from vapi-checks.yml, with bash:
    • the live-or-dry decision: own branch and manual dispatch run live; a fork, a fork with a look-alike repo name, Dependabot as actor or as PR author, a missing head repo, and a pull_request_target event all run dry;
    • the run step's arguments, with a stub node: dry vs live, a named check on dispatch, --changed-since only when the base ref exists, and empty key variables unset;
    • statically: secrets are only passed when the decision says live, the triggers are exactly pull_request and workflow_dispatch, permissions are contents: read and statuses: write, and checkout doesn't persist credentials.
  • The decision now also requires a pull_request event before going live, so adding a trigger later can't widen who gets the keys.
  • ci.yml gains an actionlint job: a pinned release whose sha256 is verified before it runs. It also runs shellcheck over every run: block.

Evidence of value

Check	Result
Remove the Dependabot-author guard from the decision step	decision test fails on "maintainer re-runs Dependabot's PR"
Current workflow	4 tests pass
actionlint	first run is this PR's CI; findings, if any, are fixed in this PR

Testing plan

• npm test (509 tests) and npx tsc --noEmit pass.
• Not tested: the workflow on GitHub's runners end to end; the PR check itself only runs once a repo sets VAPI_CHECKS_ENABLED.

Refs TEST-141

🤖 Generated with Claude Code

[scott-lowe-vapi]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat: identify every gitops API request with a User-Agent #78
• feat(validate): catch broken references and show findings on the PR #77
• ci: validate every org's resources on every pull request #76
• ci: lint workflows and test the PR check's key-sharing decision #75 👈 (View in Graphite)
• test(docs): check that doc links, commands and flags exist #74
• fix(cleanup): never delete resources matched by .vapi-ignore #73
• docs(agents): one compact guide for Claude, Codex and Cursor #72
• docs: edit the guides for new readers and fix inaccuracies #71
• docs: restructure the README into a short landing page and topic guides #70
• docs: prepare for public release: scrub internal names, fix examples, add community files #69
• feat(promotion): gate promotion out of an org on a passing check #66
• fix(promotion): commit the files of transitions that applied when a later one fails #65
• test(promotion): pin the exact files promoting an assistant writes to the target #68
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.