feat: integrate with tooling

.github/dependabot.yml

@@ -18,3 +18,15 @@ updates:
         patterns:
           - "*"
 
+
+  # .tooling test harness
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "04:00"
+      timezone: "UTC"
+    target-branch: "main"
+    commit-message:
+      prefix: "ci(tooling)"

.github/workflows/internal-actionlint.yml

@@ -0,0 +1,19 @@
+name: Lint Workflows
+
+on:
+  pull_request:
+    paths: &paths
+      - ".github/workflows/**"
+      - "**/action.yml"
+      - "**/action.yaml"
+  push:
+    branches: [main]
+    paths: *paths
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    uses: dotactions/tooling/.github/workflows/actionlint.yml@47e8ca68959cee5ae7b65b8110f4cf7d0a89decd # v1.1.0

.github/workflows/internal-check-refs.yml

@@ -0,0 +1,19 @@
+name: Check References
+
+on:
+  pull_request:
+    paths: &paths
+      - ".github/workflows/**"
+      - "**/action.yml"
+      - "**/action.yaml"
+  push:
+    branches: [main]
+    paths: *paths
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check-refs:
+    uses: dotactions/tooling/.github/workflows/check-refs.yml@47e8ca68959cee5ae7b65b8110f4cf7d0a89decd # v1.1.0

.github/workflows/internal-lint.yml

@@ -0,0 +1,20 @@
+name: Lint Scripts
+
+on:
+  pull_request:
+    paths: &paths
+      - "**.sh"
+      - "**.ps1"
+      - ".tooling"
+      - ".github/workflows/internal-lint.yml"
+  push:
+    branches: [main]
+    paths: *paths
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    uses: dotactions/tooling/.github/workflows/lint.yml@47e8ca68959cee5ae7b65b8110f4cf7d0a89decd # v1.1.0

.github/workflows/internal-release.yml

@@ -0,0 +1,19 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to release (e.g. 0.1.0, v0.1.0 or 0.1.0-rc.1)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    uses: dotactions/tooling/.github/workflows/release.yml@47e8ca68959cee5ae7b65b8110f4cf7d0a89decd # v1.1.0
+    with:
+      version: ${{ inputs.version }}
+    secrets: inherit

.github/workflows/internal-test-scripts.yml

@@ -0,0 +1,21 @@
+name: Test Scripts
+
+on:
+  pull_request:
+    paths: &paths
+      - "**/scripts/**"
+      - "build/targets.json"
+      - "tests/*.sh"
+      - ".tooling"
+      - ".github/workflows/internal-test-scripts.yml"
+  push:
+    branches: [main]
+    paths: *paths
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test-scripts:
+    uses: dotactions/tooling/.github/workflows/test-scripts.yml@47e8ca68959cee5ae7b65b8110f4cf7d0a89decd # v1.1.0

.gitmodules

@@ -0,0 +1,3 @@
+[submodule ".tooling"]
+	path = .tooling
+	url = https://github.com/dotactions/tooling

AGENTS.md

@@ -62,7 +62,7 @@ Opinionated composite actions and reusable workflows for building and shipping F
 ## Testing
 
 - Composite actions are tested via `uses: ./<action>` in `internal-test.yml`, with assertions on outputs and produced files. Add or extend a test for every behavioural change.
-- Script logic is unit-tested in `tests/<name>.test.sh` using the harness from the `.tooling` submodule (`source "$(dirname "$0")/../.tooling/tests/lib.sh"`; run `git submodule update --init` first). `internal-test-scripts.yml` runs every one on ubuntu, macOS and Windows. Add cases for every branch you change.
+- Script logic is unit-tested in `tests/<name>.test.sh` using the harness from the `.tooling` submodule (`source "$(dirname "$0")/../.tooling/tests/lib.sh"`; run `git submodule update --init` first). Dependabot (`gitsubmodule`) bumps `.tooling` to tooling `main`; merge those PRs only when the script tests pass. `internal-test-scripts.yml` runs every one on ubuntu, macOS and Windows. Add cases for every branch you change.
 - Each `internal-*` workflow has a `paths:` filter. When adding files that a workflow should cover, update its filter.
 - Local checks before finishing (run whichever apply):
     - `shellcheck <changed .sh files>`