build(deps): bump lentago/shared-workflows/.github/workflows/tf-lint.yml from 1.2.0 to 1.2.2 in the actions-routine group

[dependabot]

Bumps the actions-routine group with 1 update: lentago/shared-workflows/.github/workflows/tf-lint.yml.

Updates lentago/shared-workflows/.github/workflows/tf-lint.yml from 1.2.0 to 1.2.2

Release notes

Sourced from lentago/shared-workflows/.github/workflows/tf-lint.yml's releases.

v1.2.2 — shellcheck hardening: preinstalled binary + job timeout

Patch release. The shellcheck reusable now uses the runner's preinstalled ShellCheck with a guarded apt fallback (a stalled apt mirror was silently wedging required checks for 20+ minutes — three times on 2026-08-19; #53), and carries a 5-minute job timeout backstop. Internal composite-action refs bumped to v1.2.2 per RELEASING.md. No input or contract changes.

v1.2.1 — Dependabot action bumps inside the reusables

Patch release per the semver policy (SHA-pinned third-party action updates, no caller-facing interface changes): checkout v7.0.1, setup-node v7.0.0, upload-artifact v7.0.1, aws-actions/configure-aws-credentials v6.2.3, codeql-action/upload-sarif v4.37.7 across the reusable workflows (#49).

Checkout/setup-node v7 are already proven green across the fleet's own workflows tonight. The deploy-path bump (configure-aws-credentials v4→v6 inside site-deploy.yml) is exercised only by a real deploy: the first consumer that bumps to v1.2.1 should watch its post-merge deploy run — the same acceptance pattern the v1.1.x rollout used.

Commits

• c5374a4 chore(release): bump internal composite-action refs to v1.2.2 ahead of taggin...
• 043005d fix(shellcheck): use preinstalled shellcheck with guarded apt fallback (#54)
• 47af63e chore(deps): Bump the actions-major group across 1 directory with 5 updates (...
• 7ee62dd docs: enforced-surfaces row — .github settings now terraform apply-on-merge (...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions