Resolve pending commit links

Refs #39

.gitea/workflows/ci.yml

@@ -1,7 +1,8 @@
-# Continuous integration for the squirrel census project: runs the pytest tests
-# on Python 3.13 for every push and pull request. Read by Gitea Actions (a
-# runner must be registered for the repository). It changes nothing outside the
-# repository and uses no secret. Decision: MIL-001 task "Add CI workflow".
+# Continuous integration for the squirrel census project: lints the YAML and
+# workflow files and runs the pytest tests on Python 3.13 for every push and
+# pull request. Read by Gitea Actions (a runner must be registered for the
+# repository). It changes nothing outside the repository and uses no secret.
+# Decision: MIL-001 task "Add CI workflow".
 # Host: Gitea Actions; uses only github.* contexts, so it also runs on GitHub.
 
 name: Tests
@@ -42,5 +43,11 @@ jobs:
           .venv/bin/python -m pip install --upgrade "pip==${PIP_VERSION}"
           .venv/bin/python -m pip install -e ".[dev]"
 
+      - name: Lint the YAML files
+        run: .venv/bin/python -m yamllint -c .yamllint.yml .gitea .yamllint.yml
+
+      - name: Lint the workflow files
+        run: .venv/bin/actionlint .gitea/workflows/*.yml
+
       - name: Run the tests
         run: .venv/bin/python -m pytest

.yamllint.yml

@@ -6,3 +6,6 @@ rules:
     max: 100
   truthy:
     check-keys: false
+  # Line endings are normalised by git (LF in the repository, CRLF in some
+  # Windows checkouts), so the rule would fail on a local checkout only.
+  new-lines: disable

README.md

@@ -20,7 +20,7 @@ There are no runtime dependencies: the program uses only the Python standard lib
 ## Set up
 
 Create a local virtual environment named `.venv` in the project folder, upgrade `pip`
-and install the project with its development tools (pytest, ruff, mypy).
+and install the project with its development tools (pytest, ruff, mypy, yamllint, actionlint).
 
 ### Windows powershell
 
@@ -90,7 +90,8 @@ it is present.
 
 The workflow [`.gitea/workflows/ci.yml`][ci] runs for every push to `main` and for every
 pull request. It sets up Python 3.13, creates a `.venv`, upgrades `pip`, installs the
-project with `.[dev]` and runs `python -m pytest`. It uses `github.*` contexts only, so
+project with `.[dev]`, lints the YAML and workflow files with `yamllint` and
+`actionlint`, and runs `python -m pytest`. It uses `github.*` contexts only, so
 it also runs on GitHub Actions.
 
 ## Build the source documentation

docs/artifact-registry.md

@@ -16,7 +16,7 @@ document of a type. `Primary File` may contain a glob (e.g.
 | PP | Project Plan | docs/project-plan.md | 002 |
 | MIL | Milestone / Gateway | docs/milestones/*.md | 005 |
 | ADR | Architecture Decision Record | docs/adr/adr-NNNN-*.md | 0002 |
-| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 031 |
+| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 034 |
 | DICT | Domain Dictionary | docs/dictionary.md | 002 |
 | TM | Traceability Matrix | docs/sqa/traceability-matrix.md | 002 |
 | UCD | Use Case Diagram | docs/use-case-diagram.md | 002 |

docs/milestones/mil-001-project-scaffold.md

@@ -11,8 +11,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-13 | Deprecated | Jens Tirsvad Nielsen | AI as stand-in for S01 | CrossReference: added [US-001] | [259d017] |
-| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Added task 7: static workflow test (RC-010 action item) | [6fb75dd] |
+| 2026-10-13 | Deprecated | Jens Tirsvad Nielsen | AI as stand-in for S01 | Added task 7: static workflow test (RC-010 action item) | [6fb75dd] |
+| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Added task 8: lint steps in CI (recorded after the work) | [78a0d02] |
 ---
 
 ## Purpose
@@ -68,10 +68,11 @@ A branch merged to `main` containing `.gitignore`, `pyproject.toml`, `src/squirr
 | 5 | Add CI workflow | Add a Gitea Actions workflow that sets up Python 3.13, creates a venv, upgrades pip, installs the dev extra and runs pytest on push and pull request. It backs the "Continuous integration" section of the README. | No |  |
 | 6 | Set repository description and topics | Use the Gitea API with the token from `.env` (read by the shell only, never by the project) to set a description and topics such as `python`, `csv`, `squirrel-census`, `udemy`, `100-days-of-code`, `pytest`. Satisfies stakeholder S03. | No |  |
 | 7 | Add static workflow test | Add `tests/test_workflow.py`, run by pytest on every pull request, that parses `.gitea/workflows/ci.yml` with a safe YAML loader and checks the required keys, explicit permissions, runner and timeout, named steps, exact-tag action pins and the five-line limit on `run:` blocks. Closes criterion 24 (optional) of the workflow review RC-010. | No | RC-010 |
+| 8 | Run yamllint and actionlint in CI | Add two steps to `.gitea/workflows/ci.yml` that run `yamllint` on `.gitea` and `.yamllint.yml` and `actionlint` on the workflow files, after the dev extra is installed, so a malformed workflow fails the pull request. Done in pull request 39 at the request of S01 and recorded here afterwards; reviewed in RC-031 and RC-032. | No | RC-031, RC-032 |
 
 ---
 
 [BC-001]: ../business-case.md
 [US-001]: ../user-stories.md
-[259d017]: https://git.tirsystem.com/Tirsvad-Udemy-100-days-of-code/025-squirrel/commit/259d017ad257059330eb9a8bdbf940c9d082664e
 [6fb75dd]: https://git.tirsystem.com/Tirsvad-Udemy-100-days-of-code/025-squirrel/commit/6fb75ddb8671636869b859d8718d3f3f8783659c
+[78a0d02]: https://git.tirsystem.com/Tirsvad-Udemy-100-days-of-code/025-squirrel/commit/78a0d02bf373b92163f45d93449dd1009b62e568

docs/sqa/reviews/rc-007-dictionary.md

@@ -9,7 +9,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Initial version | [f1b3c03] |
+| 2026-10-13 | Deprecated | Jens Tirsvad Nielsen | AI as stand-in for S01 | Initial version | [f1b3c03] |
+| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Action item closed: criteria 3 and 4 re-reviewed in RC-018 (Go) | [40c3387] |
 
 ---
 
@@ -65,3 +66,4 @@ Go-with-conditions — criteria 3 and 4 cannot be checked until DM-001 and the d
 [QC-DICT-001]: ../../../framework/qc/artifacts/qc-dictionary.md
 [QC-LANG-001]: ../../../framework/qc/artifacts/qc-language-domain.md
 [f1b3c03]: https://git.tirsystem.com/Tirsvad-Udemy-100-days-of-code/025-squirrel/commit/f1b3c034dc3880b7884646b4a4ed28e5f98fbcd3
+[40c3387]: https://git.tirsystem.com/Tirsvad-Udemy-100-days-of-code/025-squirrel/commit/40c3387ea7a4b601e8d20a5a7b6eba20c3d5323d

docs/sqa/reviews/rc-010-ci-workflow.md

@@ -9,7 +9,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-13 | Proposed | Jens Tirsvad Nielsen | AI as stand-in for S01 | Initial version | [d71b586] |
+| 2026-10-13 | Deprecated | Jens Tirsvad Nielsen | AI as stand-in for S01 | Initial version | [d71b586] |
+| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Action items closed: criterion 22 by RC-025 (Go), criterion 24 by RC-030 (Go) | [40c3387] |
 
 ---
 
@@ -67,3 +68,4 @@ Go-with-conditions — all Mandatory criteria pass except 22: the workflow has n
 [WF-MIL-001]: ../../../.gitea/workflows/ci.yml
 [QC-WF-001]: ../../../framework/qc/code/qc-workflow.md
 [d71b586]: https://git.tirsystem.com/Tirsvad-Udemy-100-days-of-code/025-squirrel/commit/d71b5863eba3dc29c5a5e09e4ffa087c67565fae
+[40c3387]: https://git.tirsystem.com/Tirsvad-Udemy-100-days-of-code/025-squirrel/commit/40c3387ea7a4b601e8d20a5a7b6eba20c3d5323d

docs/sqa/reviews/rc-031-ci-yaml-lint-steps.md

@@ -0,0 +1,48 @@
+# RC Review of ci.yml, delta re-review for the lint steps (YAML)
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | RC-031 |
+| CrossReference | [WF-MIL-001], [QC-YML-001] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Initial version | [e406d65] |
+
+---
+
+## Artifact Under Review
+
+- Instance reviewed: [WF-MIL-001]
+- Checklist used: [QC-YML-001]
+- Scope: delta re-review of criteria 3, 7, 10 and 15 of QC-YML-001: two lint steps added to ci.yml; earlier record RC-009
+- Language and domain: n/a
+- Language reviewer: none (the stand-in reviewer reads English and the `it` domain)
+- Mode: autonomous, not independent (reviewer: AI as stand-in for S01)
+
+## Checklist Results
+
+| # | Criterion | Status | Evidence/Notes |
+| --- | --- | --- | --- |
+| 3 | Passes `yamllint` (or the project's YAML linter) with its configuration committed next to the code and no unexplained `disable` comments (Mandatory) | Pass | `yamllint 1.38.0` with `.yamllint.yml` runs in CI on `.gitea` and `.yamllint.yml`; no errors. `new-lines` is disabled with a comment because git normalises line endings. |
+| 7 | Embedded program text (shell, Python, SQL, `jq`, and so on) in a value is at most five lines; a longer one is moved to a file of its own, in its own language, and the YAML calls it (Mandatory) | Pass | The two new `run:` blocks have one line each; the longest block is still 3 lines. |
+| 10 | The file validates against the schema of the consuming tool where one exists, and the schema or tool version is stated (Optional) | Pass | `actionlint` validates the workflow schema in CI. |
+| 15 | A change is exercised by a check that runs without the real target: a parse and schema test, or a dry run of the consuming tool (Optional) | Pass | yamllint and actionlint now run on every push and pull request without the real target. |
+
+## Overall Verdict
+
+Go — the changed rows pass; the other rows of RC-009 still hold.
+
+## Action Items
+
+| Action | Owner | Due |
+| --- | --- | --- |
+| None | S01 | - |
+
+---
+
+[WF-MIL-001]: ../../../.gitea/workflows/ci.yml
+[QC-YML-001]: ../../../framework/qc/code/qc-yaml.md
+[e406d65]: https://git.tirsystem.com/Tirsvad-Udemy-100-days-of-code/025-squirrel/commit/e406d65f6a53332750204ec3fd876ab2daa2bbd2

docs/sqa/reviews/rc-032-ci-workflow-lint-steps.md

@@ -0,0 +1,50 @@
+# RC Review of ci.yml, delta re-review for the lint steps (workflow)
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | RC-032 |
+| CrossReference | [WF-MIL-001], [QC-WF-001] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Initial version | [e406d65] |
+
+---
+
+## Artifact Under Review
+
+- Instance reviewed: [WF-MIL-001]
+- Checklist used: [QC-WF-001]
+- Scope: delta re-review of criteria 5, 6, 17, 20, 22 and 24 of QC-WF-001: two lint steps added; earlier records RC-010, RC-025, RC-030
+- Language and domain: n/a
+- Language reviewer: none (the stand-in reviewer reads English and the `it` domain)
+- Mode: autonomous, not independent (reviewer: AI as stand-in for S01)
+
+## Checklist Results
+
+| # | Criterion | Status | Evidence/Notes |
+| --- | --- | --- | --- |
+| 5 | Every job and step has a descriptive `name`, unique within its job (Mandatory) | Pass | The new steps are named "Lint the YAML files" and "Lint the workflow files"; step names stay unique. |
+| 6 | The file passes `actionlint` (or the project's workflow validation test) and the tool version is stated (Mandatory) | Pass | `actionlint 1.7.12` runs in CI against `.gitea/workflows/*.yml` and passes. |
+| 17 | Tools and dependencies are installed at pinned versions; a version is a workflow input with a default or a value in one place (Mandatory) | Pass | `yamllint==1.38.0` and `actionlint-py==1.7.12.25` are exact pins in the dev extra of `pyproject.toml`. |
+| 20 | A `run:` block is within the limit on embedded program text of criterion 7 of [QC-YML-001]; a longer script is a file (`tools/`, or a shared repository fetched at a pinned ref) that the step calls with one command, and the workflow passes its settings through `env:` (Mandatory) | Pass | Each new `run:` block is one line. |
+| 22 | Every workflow feature used is verified on the instance that runs it, and the host and version are recorded; a feature the target hosts differ on is noted in the header (Mandatory) | Pass | The changed workflow completed with success on Gitea 1.27.3: run 1087 on pull request #39. |
+| 24 | A static test of the repository's workflows exists and runs on every pull request: valid YAML, required keys, explicit permissions and runner, no inline script above the limit (Optional) | Pass | `tests/test_workflow.py` still passes (33 tests) with the new steps. |
+
+## Overall Verdict
+
+Go — the changed rows pass; the other rows of RC-010, RC-025 and RC-030 still hold.
+
+## Action Items
+
+| Action | Owner | Due |
+| --- | --- | --- |
+| None | S01 | - |
+
+---
+
+[WF-MIL-001]: ../../../.gitea/workflows/ci.yml
+[QC-WF-001]: ../../../framework/qc/code/qc-workflow.md
+[e406d65]: https://git.tirsystem.com/Tirsvad-Udemy-100-days-of-code/025-squirrel/commit/e406d65f6a53332750204ec3fd876ab2daa2bbd2

docs/sqa/reviews/rc-033-mil-001-task-8.md

@@ -0,0 +1,57 @@
+# RC-033 Review of MIL-001
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | RC-033 |
+| CrossReference | [MIL-001], [QC-MIL-001], [QC-LANG-001] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Initial version | [78a0d02] |
+
+---
+
+## Artifact Under Review
+
+- Instance reviewed: [MIL-001]
+- Checklist used: [QC-MIL-001] and [QC-LANG-001]
+- Scope: delta re-review of criteria 1 and 2 and criteria 1, 2, 6, 7, 8 of QC-LANG-001: task 8 added to the Tasks section
+- Language and domain: en / it
+- Language reviewer: none (the stand-in reviewer reads English and the `it` domain)
+- Mode: autonomous, not independent (reviewer: AI as stand-in for S01)
+
+## Checklist Results
+
+| # | Criterion | Status | Evidence/Notes |
+| --- | --- | --- | --- |
+| 1 | A concrete deliverable is defined for every gate (Mandatory) | Pass | Deliverable unchanged; the new task extends the CI workflow already in the deliverable. |
+| 2 | Explicit Go/No-Go criteria are stated for each gate (Mandatory) | Pass | Go / No-Go criteria unchanged and objectively checkable; the lint steps run in the same CI run as criterion 3. |
+
+## Language and Domain Results
+
+| # | Criterion | Status | Evidence/Notes |
+| --- | --- | --- | --- |
+| 1 | The Metadata table has a `Language` row and a `Domain` row, and neither is a placeholder (Mandatory) | Pass | Unchanged. |
+| 2 | `Language` is a BCP 47 code and `Domain` is a value from the registry's domain list (Mandatory) | Pass | Unchanged. |
+| 6 | Metadata keys, section headings, IDs and statuses are in English (Mandatory) | Pass | Keys, headings and statuses are English. |
+| 7 | No translated twin (`<name>.<language>.md`) exists beside the document (Mandatory) | Pass | No translated twin. |
+| 8 | A change of language or domain since the previous accepted version has a Version History row and was reviewed again (Mandatory) | Pass | Language unchanged. |
+
+## Overall Verdict
+
+Go — one task row was added at the request of S01 in chat, after the work was done and reviewed in RC-031 and RC-032; the gate criteria and deliverable are unchanged.
+
+## Action Items
+
+| Action | Owner | Due |
+| --- | --- | --- |
+| None | S01 | - |
+
+---
+
+[MIL-001]: ../../milestones/mil-001-project-scaffold.md
+[QC-MIL-001]: ../../../framework/qc/artifacts/qc-milestones-gateways.md
+[QC-LANG-001]: ../../../framework/qc/artifacts/qc-language-domain.md
+[78a0d02]: https://git.tirsystem.com/Tirsvad-Udemy-100-days-of-code/025-squirrel/commit/78a0d02bf373b92163f45d93449dd1009b62e568

docs/sqa/traceability-matrix.md

@@ -27,7 +27,7 @@ updated whenever an artifact instance is created or reviewed.
 | [BC-001] | Business Case | en | it | - | [SA-001], [PP-001], [MIL-001], [MIL-002], [MIL-003], [MIL-004] | [RC-001], [RC-019], [RC-026] |
 | [SA-001] | Stakeholder Analysis | en | it | [BC-001] | [PP-001] | [RC-002] |
 | [PP-001] | Project Plan | en | it | [BC-001], [SA-001] | [MIL-001], [MIL-002], [MIL-003], [MIL-004] | - (no checklist; accepted by S01 in chat) |
-| [MIL-001] | Milestone | en | it | [BC-001], [PP-001] | - | [RC-003], [RC-020], [RC-028] |
+| [MIL-001] | Milestone | en | it | [BC-001], [PP-001] | - | [RC-003], [RC-020], [RC-028], [RC-033] |
 | [MIL-002] | Milestone | en | it | [BC-001], [PP-001], [MIL-001] | - | [RC-004], [RC-021] |
 | [MIL-003] | Milestone | en | it | [BC-001], [PP-001], [MIL-002] | - | [RC-005], [RC-022] |
 | [MIL-004] | Milestone | en | it | [BC-001], [PP-001], [MIL-003] | - | [RC-006], [RC-023], [RC-027] |
@@ -42,7 +42,7 @@ updated whenever an artifact instance is created or reviewed.
 | `src/squirrel/census.py`, `cli.py`, `__main__.py`, `tests/` | Python Source Code | - | - | [UC-001], [SSD-001], [ADR-0001] | - | [RC-024] |
 | `src/squirrel/constants.py`, `tests/test_constants.py` | Python Source Code | - | - | [MIL-001] | - | [RC-008] |
 | `tests/test_workflow.py` | Python Source Code | - | - | [MIL-001], [RC-010] | - | [RC-029] |
-| `.gitea/workflows/ci.yml` | CI Workflow | - | - | [MIL-001] | - | [RC-009], [RC-010], [RC-025], [RC-030] |
+| `.gitea/workflows/ci.yml` | CI Workflow | - | - | [MIL-001] | - | [RC-009], [RC-010], [RC-025], [RC-030], [RC-031], [RC-032] |
 
 ## Coverage Notes
 
@@ -98,3 +98,6 @@ updated whenever an artifact instance is created or reviewed.
 [RC-029]: ./reviews/rc-029-python-workflow-test.md
 [RC-030]: ./reviews/rc-030-ci-workflow-delta-24.md
 [dfaa840]: https://git.tirsystem.com/Tirsvad-Udemy-100-days-of-code/025-squirrel/commit/dfaa8400c3bd24b086a2c3eab1bef1e4e7ea6b45
+[RC-031]: ./reviews/rc-031-ci-yaml-lint-steps.md
+[RC-032]: ./reviews/rc-032-ci-workflow-lint-steps.md
+[RC-033]: ./reviews/rc-033-mil-001-task-8.md

pyproject.toml

@@ -22,7 +22,8 @@ classifiers = [
 
 [project.optional-dependencies]
 dev = ["pytest==9.1.1", "ruff==0.17.0", "mypy==2.4.0",
-  "pyyaml==6.0.3", "types-PyYAML==6.0.12.20260906"]
+  "pyyaml==6.0.3", "types-PyYAML==6.0.12.20260906",
+  "yamllint==1.38.0", "actionlint-py==1.7.12.25"]
 
 [tool.setuptools.packages.find]
 where = ["src"]

wiki/Install.da.md

@@ -2,7 +2,7 @@
 
 # Installation
 
-Projektet kræver **Python 3.13 eller nyere**. Det har ingen kørselsafhængigheder; `pytest`, `ruff` og `mypy` er udviklingsværktøjer.
+Projektet kræver **Python 3.13 eller nyere**. Det har ingen kørselsafhængigheder; `pytest`, `ruff`, `mypy`, `yamllint` og `actionlint` er udviklingsværktøjer.
 
 ## Windows PowerShell
 

wiki/Install.md

@@ -2,7 +2,7 @@
 
 # Install
 
-The project needs **Python 3.13 or later**. It has no runtime dependencies; `pytest`, `ruff` and `mypy` are development tools.
+The project needs **Python 3.13 or later**. It has no runtime dependencies; `pytest`, `ruff`, `mypy`, `yamllint` and `actionlint` are development tools.
 
 ## Windows PowerShell
 

wiki/Install.ms.md

@@ -2,7 +2,7 @@
 
 # Pemasangan
 
-Projek ini memerlukan **Python 3.13 atau lebih baharu**. Ia tiada kebergantungan masa jalan; `pytest`, `ruff` dan `mypy` ialah alat pembangunan.
+Projek ini memerlukan **Python 3.13 atau lebih baharu**. Ia tiada kebergantungan masa jalan; `pytest`, `ruff`, `mypy`, `yamllint` dan `actionlint` ialah alat pembangunan.
 
 ## Windows PowerShell