ci: bump wearerequired/lint-action from 2 to 3

[dependabot]

Bumps wearerequired/lint-action from 2 to 3.

Release notes

Sourced from wearerequired/lint-action's releases.

v3.0.0

This is a major release. lint-action now runs on Node.js 24, adds several new linters, and ships a security fix along with many robustness improvements accumulated since v2.3.0.

⚠️ Breaking changes

• Runs on Node.js 24. GitHub-hosted runners handle this automatically; self-hosted runners must be updated to Actions Runner ≥ 2.327.1. (#995)
• ERB Lint now requires erb_lint ≥ 0.7.0. The action calls the erb_lint executable instead of the deprecated erblint shim (which is broken on Windows). (#997, #1001)

✨ New linters

• Ruff — Python (#1013)
• Standard Ruby (standardrb) — Ruby (#1008)
• isort — Python (#1006)
• staticcheck — Go (#1004)
• clippy — Rust (#586)
• rustfmt — Rust (#585)

🔒 Security

• Fixed a command-injection vulnerability: an attacker-controlled pull request branch name (from a fork) was interpolated unquoted into shell commands. All interpolated values are now shell-escaped. (#1002)

🐛 Fixes & improvements

• stylelint 16 is now supported (it prints its report to stderr). (#993)
• Annotations now work with [linter]_dir, and dotnet-format annotations show up on Windows — annotation paths are made repo-root-relative and use forward slashes. (#1012, fixes #94 and #608)
• More than 50 annotations are sent to the Checks API in batches instead of dropping everything after the first 50. (#1005, fixes #749)
• Prettier no longer fails with an opaque 422 error when it cannot parse a file; the parse error is surfaced as an annotation. (#1003, fixes #718)
• Fixed checking out the pull request branch when it is already checked out, and made the fetch/push robust. (#1000, fixes #193)
• The swift-format (official) linter is tested again — now on macOS, Linux and Windows. (#1009, #1010, #1011, fixes #213)

🗑️ Deprecations

• golint is deprecated (its upstream is frozen and archived) — use staticcheck instead. (#1004)

🧰 Under the hood

• Toolchain and workflow modernization: Node 24, Python 3.14, Ruby 4.0, Go stable, current linter and GitHub Actions versions, and refreshed test fixtures. (#996, #997, #998)

Full changelog: wearerequired/lint-action@v2.3.0...v3.0.0

v2.3.0

What's Changed

• Add support for tsc to check TypeScript files by @​zirkelc in wearerequired/lint-action#575

New Contributors

• @​zirkelc made their first contribution in wearerequired/lint-action#575

Full Changelog: wearerequired/lint-action@v2.2.0...v2.3.0

v2.2.0

... (truncated)

Commits

• 60bed9b Capture stylelint stderr on clean CSS (exit 0) (#1016)
• 52d6fc5 [auto] Update compiled version
• 8803ad8 Prepare v3.0.0 release (#1015)
• 588d984 Bump flatted from 3.2.7 to 3.4.2 in /test/linters/projects/eslint (#1014)
• e6d012b Add support for the Ruff Python linter (#1013)
• 38de992 Make annotation paths repo-root-relative and use forward slashes (#1012)
• 73740b6 Test swift-format (official) on Windows too (#1011)
• f651ccd Test swift-format (official) on Linux too (#1010)
• ea030b1 Re-enable the swift-format (official) linter tests on macOS (#1009)
• c1010fa Add support for the Standard Ruby (standardrb) linter (#1008)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)