🌱 Bump github.com/rhysd/actionlint from 1.7.9 to 1.7.11

[dependabot]

Bumps github.com/rhysd/actionlint from 1.7.9 to 1.7.11.

Release notes

Sourced from github.com/rhysd/actionlint's releases.

v1.7.11

• Support the case() function in ${{ }} expressions which was recently added to GitHub Actions. (#612, #614, thanks @​heppu)

  env:
    # ERROR: case() requires an odd number of arguments
    ENVIRONMENT: |-
      ${{ case(
        github.ref == 'refs/heads/main', 'production',
        github.ref == 'refs/heads/staging', 'staging'
      ) }}

• Support new macos-26-large and windows-2025-vs2026 runner labels. See the GitHub's announce for more details. (#615, thanks @​hugovk and @​muzimuzhi)
• Enable Artifact attestations for the released binaries. From v1.7.11 gh command can verify the integrity of the downloaded binaries as follows. The verification is highly recommended in terms of supply chain security. (#608, thanks @​takaram)

  $ gh release download --repo rhysd/actionlint --pattern '*_darwin_amd64.tar.gz' v1.7.11
  $ gh attestation verify --repo rhysd/actionlint actionlint_1.7.11_darwin_amd64.tar.gz
  Loaded digest sha256:17ffc17fed8f0258ef6ad4aed932d3272464c7ef7d64e1cb0d65aa97c9752107 for file://actionlint_1.7.11_darwin_amd64.tar.gz
  Loaded 1 attestation from GitHub API
  The following policy criteria will be enforced:
  
  Predicate type must match:................ https://slsa.dev/provenance/v1
  Source Repository Owner URI must match:... https://github.com/rhysd
  Source Repository URI must match:......... https://github.com/rhysd/actionlint
  Subject Alternative Name must match regex: (?i)^https://github.com/rhysd/actionlint/
  OIDC Issuer must match:................... https://token.actions.githubusercontent.com
  
  ✓ Verification succeeded!
  The following 1 attestation matched the policy criteria
  
  Attestation #1
  
  Build repo:..... rhysd/actionlint
  Build workflow:. .github/workflows/release.yaml@refs/tags/v1.7.11
  Signer repo:.... rhysd/actionlint
  Signer workflow: .github/workflows/release.yaml@refs/tags/v1.7.11

Report path filters with ./ as error because they never match anything. (#521)

on:
  push:
    paths:
      # ERROR: This never matches anything. `foo/bar.txt` is correct.
      - ./foo/bar.txt

Fix comparing matrix items when an item is a super set of another item. (#523, #613, thanks @​michaelgruenewald)

Fix stack overflow crash by a recursive anchor in matrix items. (#610)

Fix an unassigned variable false positive from shellcheck by disabling SC2153 rule. (#573)

Reduce the number of memory allocations on resolving anchors.

Update the popular actions data set to the latest.

Update Go dependencies to the latest.

... (truncated)

Changelog

Sourced from github.com/rhysd/actionlint's changelog.

v1.7.11 - 2026-02-14

• Support the case() function in ${{ }} expressions which was recently added to GitHub Actions. (#612, #614, thanks @​heppu)

  env:
    # ERROR: case() requires an odd number of arguments
    ENVIRONMENT: |-
      ${{ case(
        github.ref == 'refs/heads/main', 'production',
        github.ref == 'refs/heads/staging', 'staging'
      ) }}

• Support new macos-26-large and windows-2025-vs2026 runner labels. See the GitHub's announce for more details. (#615, thanks @​hugovk and @​muzimuzhi)
• Enable Artifact attestations for the released binaries. From v1.7.11 gh command can verify the integrity of the downloaded binaries as follows. The verification is highly recommended in terms of supply chain security. (#608, thanks @​takaram)

  $ gh release download --repo rhysd/actionlint --pattern '*_darwin_amd64.tar.gz' v1.7.11
  $ gh attestation verify --repo rhysd/actionlint actionlint_1.7.11_darwin_amd64.tar.gz
  Loaded digest sha256:17ffc17fed8f0258ef6ad4aed932d3272464c7ef7d64e1cb0d65aa97c9752107 for file://actionlint_1.7.11_darwin_amd64.tar.gz
  Loaded 1 attestation from GitHub API
  The following policy criteria will be enforced:
  
  Predicate type must match:................ https://slsa.dev/provenance/v1
  Source Repository Owner URI must match:... https://github.com/rhysd
  Source Repository URI must match:......... https://github.com/rhysd/actionlint
  Subject Alternative Name must match regex: (?i)^https://github.com/rhysd/actionlint/
  OIDC Issuer must match:................... https://token.actions.githubusercontent.com
  
  ✓ Verification succeeded!
  The following 1 attestation matched the policy criteria
  
  Attestation #1
  
  Build repo:..... rhysd/actionlint
  Build workflow:. .github/workflows/release.yaml@refs/tags/v1.7.11
  Signer repo:.... rhysd/actionlint
  Signer workflow: .github/workflows/release.yaml@refs/tags/v1.7.11

Report path filters with ./ because they never match anything. (#521)

on:
  push:
    paths:
      # ERROR: This never matches anything. `foo/bar.txt` is correct.
      - ./foo/bar.txt

Fix comparing matrix items when an item is a super set of another item. (#523, #613, thanks @​michaelgruenewald)

Fix stack overflow crash by a recursive anchor in matrix items. (#610)

Fix a unassigned variable false positive from shellcheck by disabling SC2153 rule. (#573)

Reduce the number of memory allocations on resolving anchors.

Update the popular actions data set to the latest.

... (truncated)

Commits

• 393031a bump up version to v1.7.11
• 63589e8 add link to the release note of the version in playground heading
• 58a2626 remove legacy Homebrew formula
• d22c104 fix test script for download script to check error case failures
• 50d2134 describe how to download and verify artifact using gh (fix #617)
• 226bb4a update playground npm deps including jsdom v28
• 1e85edb disable SC2153 shellcheck rule to avoid unassigned variable false positive (f...
• 8776d64 Merge pull request #619 from takaram/patch-1
• e3eb8cb reduce memory allocations on resolving anchors
• db08cec Fix variable name in release workflow
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)