[Nawid3333]

Since #60, nearly all of #10 arrives by itself: Node's LTS major as a pull request for you, pnpm 11.x merging itself, pnpm 12 once Dependabot supports it, npm packages and GitHub Actions through Dependabot, patched libraries, mpv, runner images, Firefox stable and beta. Two pins still had no updater. This PR gives both one, adds a test so a future pin cannot go without one, and ships nothing to Firefox (no release).

What was still by hand

• The actionlint image — the check every workflow file passes in CI, and the source of the actionlint and shellcheck binaries the WSL verify uses — was pinned as a docker:// line in ci.yml. Dependabot does not update those lines (GitHub's docs say so; dependabot-core#5819), so it stayed on 1.7.12 unless bumped by hand, as the comment in dependabot.yml said.
• The composite action .github/actions/e2e-setup, the setup of every e2e job, pins browser-actions/setup-firefox v1.7.2. Dependabot's github-actions entry had directory: '/', which scans .github/workflows only, so that pin would never get a pull request. It is current today only because v1.7.2 is still the newest release.

What changes

• .github/actionlint/Dockerfile: one FROM rhysd/actionlint:1.7.12@sha256:... line, the only place the image is named. Nothing builds the image.
• ci.yml: the actionlint step reads that line, checks its form, and runs the image with docker run on the checkout (mounted read-only), in place of the docker:// line. tools/linux/setup.sh reads the same line for the WSL verify.
• dependabot.yml: a docker entry for /.github/actionlint, weekly with a 5-day cooldown, like the others. Dependabot updates the tag and the digest of such a FROM line together. The github-actions entry now watches / and /.github/actions/*.
• update-prs.yml: a Dependabot docker PR is its own kind and always waits for you, with the reason "it changes the actionlint image, the check every workflow file has to pass, which a person reviews", like the GitHub Actions PRs. Nothing about what merges itself changes.
• tests/unit/checkToolchain.test.mjs: fails if an action in a workflow or composite action is not pinned to a commit with its version as a comment, if a workflow runs a docker:// image, if Dependabot stops watching the composite actions, or if the actionlint pin is not one tag-and-digest FROM line that a docker entry watches and that ci.yml and setup.sh read.
• docs/maintenance.md: a table row for the actionlint image, and a short "Pinning a new tool" section with the rule for future pins. CLAUDE.md: the two notes that named ci.yml as the pin's place are updated.

Tests

• Lint, typecheck and the unit tests pass locally (47 files, 628 tests, 2 skipped).
• The new tests were run against 14 deliberate breakages, and each one made them fail: the docker:// line back in ci.yml; the digest missing; a second FROM line; the composite actions, or the docker entry, dropped from dependabot.yml; the docker entry watching /; an action pinned by tag; a commit pin without its version comment; an unpinned setup-firefox in e2e-setup; setup.sh or ci.yml reading another file; a job container: in a workflow; the docker kind, or its reason, dropped from update-prs.yml.
• pnpm run verify:linux workflows: actionlint 1.7.12 with shellcheck 0.11.0 passes on every workflow, the new step included, on Ubuntu 24.04 and 26.04. setup.sh took the pin from the new file (it stops with an error when it finds none).
• update-prs.yml's own branch and reason case blocks, cut out of the file and run in bash for seven branch names: dependabot/docker/... gets its reason and waits; npm, Actions, pnpm and Node branches come out as before.
• The docker run itself could not run here (no Docker on this machine). On this PR's first CI run, "Lint workflows" pulled the image by its digest and actionlint passed.
• glm-5.3-flash reviewed the whole diff and found no problems. Its three optional suggestions are in the second commit: the test also refuses job container: and services: images (Dependabot updates neither), it checks that the docker kind keeps its reason in update-prs.yml, and setup.sh takes only a full 64-digit digest.

After merging

• Dependabot's next weekly run reads the new entries. When actionlint has a release older than 5 days, you get a pull request; its CI runs the new actionlint over every workflow, and it waits for you. A future setup-firefox release arrives with the grouped GitHub Actions pull request, which waits for you as before.
• Nothing is left by hand in Late November/december 2026: toolchain and library updates #10: the Node 26 pull request (late October) and later pnpm 12 come as pull requests for you to merge. Late November/december 2026: toolchain and library updates #10 can be closed, which also stops its November 1 reminder; tell me if you want that.

🤖 Generated with Claude Code