chore(deps): update pre-commit hook kjanat/actionlint to v1.17

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
kjanat/actionlint	repository	minor	v1.16.1 → v1.17

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

kjanat/actionlint (kjanat/actionlint)

v1.17

Compare Source

• Resolve Go dependency licenses from remote module sources when generating release SBOMs. Document remaining unknown SPDX fields. (#​167)

• Document installation through aqua and mise's aqua backend, including registry availability, and pin download-script examples to a commit independently of the requested binary version. (#​168)

• Upgrade note: the three new cache safety policies are enabled even without a configuration file and can make previously clean workflows exit with status 1. Disable individual checks with policy.cache-write-untrusted: false, policy.cache-call-unrestricted: false, or policy.cache-operation: false, or document a reviewed inline exception. Existing opt-in policies retain their defaults. (#​165)

• Support current workflow schema fields and expression objects, including workflow descriptions, cancellation timeouts, image-version filters, stacked pull requests, empty choice options, disabled service images, and UTC timezone aliases.

• Validate action manifests against generated runner schema constraints. Correct workflow expression contexts, matrix inference, function arity, expression depth, scalar decoding, required flags, schedule entries, and step ID checks.

• Document the pinned workflow/action schema audit, complete definition coverage, regression evidence, and retained compatibility differences.

• Enable cache safety policies by default: report explicit writes on low-trust triggers that can use default-branch caches, reusable calls without an explicit cache limit on those triggers, and official cache actions disabled by an explicit mode. Each policy can be disabled in configuration or suppressed on a specific line with a rule name and a reason.

• Add policy.disallow-suppressions to prohibit inline cache exceptions for all or selected rules. Select report: suppression, violation, or all to report the prohibited comment, retain the original violation, or report both. (#​165)

• Support workflow- and job-level cache-mode values, including jobs that call reusable workflows. Check explicit cache access limits through nested local workflow calls, preserving job overrides and the distinction between omitted settings and none. Report invalid values and types at their source locations. (#​163)

• Report cache operations disabled by a caller's explicit limit through nested local reusable workflows, including parallel child steps. Preserve the original reusable-workflow reference in diagnostics and report lookup failures consistently regardless of file analysis order. (#​164; #​165)

[Changes][v1.17.0]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Saturday (* * * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.