feat: lint GitHub Actions workflows

Works around <dependabot/dependabot-core#8362>
for now.

.github/dependabot.yml

@@ -4,6 +4,10 @@ updates:
   directory: "/"
   schedule:
     interval: daily
+- package-ecosystem: "docker"
+  directory: "/.github/workflows"
+  schedule:
+    interval: daily
 - package-ecosystem: npm
   directory: "/"
   schedule:

.github/workflows/actionlint.dockerfile

@@ -0,0 +1,4 @@
+# Workaround for https://github.com/dependabot/dependabot-core/issues/8362.
+# Once that is fixed, remove this file and replace the Docker build and run
+# lines in `.github/workflows/main.yml` with a `uses: docker://rhysd/…` line.
+FROM rhysd/actionlint:1.6.26@sha256:2362769b1d75056da70e7af1b12d9e52746f3a123b8f22a4322869e8f2cd45f2

.github/workflows/main.yml

@@ -29,6 +29,11 @@ jobs:
       - name: format
         run: npm run format -- --fix=false # ensure eslint is not configured to --fix
 
+      - name: Download actionlint
+        run: docker build --tag actionlint - < .github/workflows/actionlint.dockerfile
+
+      - name: Run actionlint to check workflow files
+        run: docker run --volume="${PWD}:/repo" --workdir=/repo actionlint -color
 
       # Configure access to AWS / EKS
       - name: Setup kubectl