ci: clean up GitHub Actions workflows

.github/Dockerfile.act

@@ -4,6 +4,13 @@ ARG GO_VERSION
 # but `actionlint` used below requires 1.25
 FROM golang:1.25
 
+ARG ACTIONLINT_VERSION=v1.7.8
+ARG ACT_VERSION=v0.2.89
+ARG ACT_LINUX_X86_64_SHA256=0191d6f1f3b716b5c55820032605d05fc3c1cdbf581ebeff655019e5dd1524c0
+ARG ACT_LINUX_ARM64_SHA256=daa8679ba9615a74d2d0cec321dc593f21948a2a11bb65862b063d8b930f4bcb
+ARG LUACHECK_VERSION=1.2.0-1
+ARG YAMLLINT_VERSION=1.38.0
+
 ENV DEBIAN_FRONTEND=noninteractive
 ENV GOBIN=/usr/local/bin
 ENV HOME=/home/gomud
@@ -15,21 +22,35 @@ RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
-        docker.io \
         git \
+        luarocks \
         make \
         nodejs \
         npm \
         python3 \
         python3-pip \
+        shellcheck \
     && rm -rf /var/lib/apt/lists/*
 
-RUN go install github.com/rhysd/actionlint/cmd/actionlint@latest
+RUN go install github.com/rhysd/actionlint/cmd/actionlint@${ACTIONLINT_VERSION}
+
+RUN pip3 install --break-system-packages "yamllint==${YAMLLINT_VERSION}"
 
-RUN pip3 install --break-system-packages yamllint
+RUN luarocks install luacheck "${LUACHECK_VERSION}"
 
-RUN curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/nektos/act/master/install.sh \
-    | bash -s -- -b /usr/local/bin
+RUN set -eux; \
+    arch="$(dpkg --print-architecture)"; \
+    case "$arch" in \
+        amd64) act_arch=x86_64; act_sha256="${ACT_LINUX_X86_64_SHA256}" ;; \
+        arm64) act_arch=arm64; act_sha256="${ACT_LINUX_ARM64_SHA256}" ;; \
+        *) echo "Unsupported act architecture: $arch" >&2; exit 1 ;; \
+    esac; \
+    curl --proto '=https' --tlsv1.2 -sSfL \
+        -o /tmp/act.tar.gz \
+        "https://github.com/nektos/act/releases/download/${ACT_VERSION}/act_Linux_${act_arch}.tar.gz"; \
+    printf '%s  %s\n' "$act_sha256" /tmp/act.tar.gz | sha256sum -c -; \
+    tar -xzf /tmp/act.tar.gz -C /usr/local/bin act; \
+    rm -f /tmp/act.tar.gz
 
 RUN useradd --create-home --home-dir /home/gomud --shell /bin/bash gomud \
     && mkdir -p /work /home/gomud/.cache/act /home/gomud/.cache/go-build /home/gomud/go/pkg/mod \

.github/scripts/build-release-binaries.sh

@@ -5,11 +5,18 @@ script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 repo_root="$(cd -- "${script_dir}/../.." && pwd)"
 dist_dir="${RELEASE_DIST_DIR:-dist}"
 binary_version="${BINARY_VERSION:-}"
+target_asset="${RELEASE_TARGET_ASSET:-}"
+target_found=false
 
 cd "$repo_root"
 mkdir -p "$dist_dir"
 
 while IFS='|' read -r _label goos goarch goarm asset; do
+	if [ -n "$target_asset" ] && [ "$asset" != "$target_asset" ]; then
+		continue
+	fi
+	target_found=true
+
 	target="${goos}/${goarch}"
 	if [ -n "$goarm" ]; then
 		target="${target} GOARM=${goarm}"
@@ -30,3 +37,8 @@ while IFS='|' read -r _label goos goarch goarm asset; do
 	fi
 	echo "::endgroup::"
 done < <("${script_dir}/release-assets.sh" targets)
+
+if [ -n "$target_asset" ] && [ "$target_found" != true ]; then
+	printf 'Unknown release target asset: %s\n' "$target_asset" >&2
+	exit 2
+fi

.github/scripts/ci-local-act.sh

@@ -8,6 +8,8 @@ ACT_FLAGS="${ACT_FLAGS:---pull=false -P ubuntu-24.04=catthehacker/ubuntu:act-lat
 ACT_DRYRUN_SECRETS="${ACT_DRYRUN_SECRETS:--s DISCORD_WEBHOOK_URL=https://example.invalid/webhook}"
 XDG_CONFIG_HOME="${ACT_CONFIG_HOME:-${repo_root}/.github}"
 export XDG_CONFIG_HOME
+read -r -a act_flags <<<"$ACT_FLAGS"
+read -r -a act_dryrun_secrets <<<"$ACT_DRYRUN_SECRETS"
 
 mkdir -p "${XDG_CONFIG_HOME}/act"
 touch "${XDG_CONFIG_HOME}/act/actrc"
@@ -18,7 +20,7 @@ run_act() {
 	local workflow="$3"
 	shift 3
 
-	act ${ACT_FLAGS:-} --dryrun "$event" "$@" \
+	act "${act_flags[@]}" --dryrun "$event" "$@" \
 		-e "$event_file" \
 		-W "$workflow"
 }
@@ -28,9 +30,9 @@ run_act() {
 run_act push .github/act/push_master.json .github/workflows/ci.yml
 run_act pull_request .github/act/pull_request.json .github/workflows/ci.yml
 run_act pull_request .github/act/pull_request.json \
-	.github/workflows/discord-notify.yml ${ACT_DRYRUN_SECRETS:-}
+	.github/workflows/discord-notify.yml "${act_dryrun_secrets[@]}"
 run_act push .github/act/push_master.json .github/workflows/prerelease.yml
 run_act workflow_dispatch .github/act/stable_release.json \
 	.github/workflows/stable-release.yml
 run_act workflow_call .github/act/docker_package_call.json \
-	.github/workflows/docker-package.yml ${ACT_DRYRUN_SECRETS:-}
+	.github/workflows/docker-package.yml "${act_dryrun_secrets[@]}"

.github/scripts/release-assets.sh

@@ -17,9 +17,9 @@ EOF
 }
 
 binary_names() {
-	local label goos goarch goarm asset
+	local _label _goos _goarch _goarm asset
 
-	while IFS='|' read -r label goos goarch goarm asset; do
+	while IFS='|' read -r _label _goos _goarch _goarm asset; do
 		printf '%s\n' "$asset"
 	done < <(release_targets)
 }
@@ -49,13 +49,13 @@ attestation_paths() {
 }
 
 downloads_markdown() {
-	local label goos goarch goarm asset
+	local label _goos _goarch _goarm asset
 
-	while IFS='|' read -r label goos goarch goarm asset; do
-		printf -- '- %s: `%s`\n' "$label" "$asset"
+	while IFS='|' read -r label _goos _goarch _goarm asset; do
+		printf -- "- %s: \`%s\`\n" "$label" "$asset"
 	done < <(release_targets)
-	printf -- '- Datafiles: `%s`\n' "$datafiles_archive"
-	printf -- '- Checksums: `%s`\n' "$checksums_file"
+	printf -- "- Datafiles: \`%s\`\n" "$datafiles_archive"
+	printf -- "- Checksums: \`%s\`\n" "$checksums_file"
 }
 
 case "${1:-}" in