ci: actionlint, lock down checkout, race tests on three OSes

.github/workflows/ci.yml

@@ -16,8 +16,12 @@ permissions:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
@@ -38,9 +42,17 @@ jobs:
           args: --timeout=4m
 
   test:
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
@@ -50,8 +62,12 @@ jobs:
 
   vuln:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
@@ -69,18 +85,39 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
       - name: Build
         run: go build -o squad-oc ./cmd/squad-oc
 
+  actionlint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Download actionlint
+        id: get_actionlint
+        run: bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash) 1.7.12
+        shell: bash
+      - name: Check workflow files
+        run: ${{ steps.get_actionlint.outputs.executable }} -color
+        shell: bash
+
   ci:
     if: always()
-    needs: [lint, test, vuln, build]
+    permissions: {}
+    needs: [lint, test, vuln, build, actionlint]
     runs-on: ubuntu-latest
     steps:
       - name: All required jobs passed
@@ -89,3 +126,4 @@ jobs:
           test "${{ needs.test.result }}" = success
           test "${{ needs.vuln.result }}" = success
           test "${{ needs.build.result }}" = success
+          test "${{ needs.actionlint.result }}" = success

.github/workflows/release.yml

@@ -18,6 +18,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Require tag commit on origin/main
         run: |
           git fetch origin main

CONTRIBUTING.md

@@ -31,7 +31,7 @@ That talks to `opencode serve` on `127.0.0.1:4096`. The TUI (`opencode`) is not
 
 1. Branch from the default branch: `feat/…` or `fix/…`.
 2. One logical change per PR. Match existing Go style (small packages, table tests, temp dirs).
-3. `gofmt`, `go vet ./...`, and `go test ./...` must pass. CI also runs race tests, golangci-lint, govulncheck, and a build on Linux/Windows/macOS.
+3. `gofmt`, `go vet ./...`, and `go test ./...` must pass. CI also runs race tests on Linux/Windows/macOS, golangci-lint, govulncheck, actionlint, and a build on all three OSes.
 4. Update README / get-started if you add a user-visible command or flag.
 5. Open a PR. Wait for the `ci` check (lint + test + vuln + build) and one review.
 

internal/squad/themes.go

@@ -257,7 +257,11 @@ func applyThemeToCharterTitle(content, title string) string {
 		trim := strings.TrimSpace(strings.TrimSuffix(line, "\r"))
 		if strings.HasPrefix(trim, "# ") && !strings.HasPrefix(trim, "##") {
 			prefix := line[:len(line)-len(strings.TrimLeft(line, " \t"))]
-			lines[i] = prefix + "# " + title
+			eol := ""
+			if strings.HasSuffix(line, "\r") {
+				eol = "\r"
+			}
+			lines[i] = prefix + "# " + title + eol
 			break
 		}
 	}

internal/squad/themes_test.go

@@ -8,6 +8,18 @@ import (
 	"testing"
 )
 
+func TestApplyThemeToCharterTitlePreservesCRLF(t *testing.T) {
+	original := "# Lead\r\n\r\n## Mission\r\n"
+	office := applyThemeToCharterTitle(original, "Michael")
+	if office != "# Michael\r\n\r\n## Mission\r\n" {
+		t.Fatalf("office:\n%q", office)
+	}
+	restored := applyThemeToCharterTitle(office, "Lead")
+	if restored != original {
+		t.Fatalf("restored:\n%q want %q", restored, original)
+	}
+}
+
 func TestApplyThemeToTeamMarkdownInvertible(t *testing.T) {
 	raw, err := os.ReadFile("templates/squad/team.md")
 	if err != nil {
@@ -79,7 +91,7 @@ func TestApplyThemeOfficeThenNone(t *testing.T) {
 		t.Fatalf("How to work should list @michael not @lead:\n%s", officeTeam)
 	}
 	leadCharter, _ := os.ReadFile(filepath.Join(root, ".squad", "agents", "lead", "charter.md"))
-	if !strings.HasPrefix(string(leadCharter), "# Michael\n") {
+	if !strings.HasPrefix(strings.ReplaceAll(string(leadCharter), "\r\n", "\n"), "# Michael\n") {
 		t.Fatalf("charter title:\n%s", leadCharter)
 	}
 
@@ -216,7 +228,7 @@ func TestApplyThemeNoneAfterInitOrigin(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !strings.HasPrefix(string(lead), "# Lead\n") {
+	if !strings.HasPrefix(strings.ReplaceAll(string(lead), "\r\n", "\n"), "# Lead\n") {
 		t.Fatalf("charter title:\n%s", lead)
 	}
 	if strings.Contains(string(lead), ".squad/agents/michael/") {