Actionlint Versions Save

• macos-14
• macos-14-xlarge
• macos-14-large

self-hosted-runner:
    labels:
      - private-linux-*

• google-github-actions/auth
• google-github-actions/get-secretmanager-secrets
• google-github-actions/setup-gcloud
• google-github-actions/upload-cloud-storage
• pulumi/actions
• pypa/gh-action-pypi-publish

• windows-latest-8-cores
• ubuntu-latest-4-cores
• ubuntu-latest-8-cores
• ubuntu-latest-16-cores

• enqueued
• dequeued
• milestoned
• demilestoned

# Enable some optional rules
SHELLCHECK_OPTS='--enable=avoid-nullary-conditions' actionlint
# Disable some rules
SHELLCHECK_OPTS='--exclude=SC2129' actionlint

• By these additions, now actionlint can output the result in the SARIF format. SARIF is a format for the output of static analysis tools used by GitHub CodeQL. the example Go template to format actionlint output in SARIF.

  actionlint -format "$(cat /path/to/sarif_template.txt)" > output.json
  

• allKinds returns the kinds (lint rules) information as an array. You can include what lint rules are defined in the command output.
• toPascalCase converts snake case (foo_bar) or kebab case (foo-bar) into pascal case (FooBar).

# ERROR: All the following `if:` conditions are always evaluated to true
- run: echo 'Commit is pushed'
  if: |
    ${{ github.event_name == 'push' }}
- run: echo 'Commit is pushed'
  if: "${{ github.event_name == 'push' }} "
- run: echo 'Commit is pushed to main'
  if: ${{ github.event_name == 'push' }} && ${{ github.ref_name == 'main' }}

env:
  "${{ steps.x.outputs.value }}": "..."

strategy:
  matrix:
    test:
      # Matrix rows are assigned from JSON string
      - ${{ fromJson(inputs.matrix) }}
steps:
  - run: echo ${{ matrix.test.foo.bar }}

strategy:
  matrix:
    build-type:
      - debug
      - ${{ fromJson(inputs.custom-build-type) }}
    exclude:
      # 'release' is not listed in 'build-type' row, but it should not be reported as error
      # since the second row of 'build-type' is dynamically constructed with ${{ }}.
      - build-type: release

matrix:
  os:
    - name: Ubuntu
      matrix: ubuntu
    - name: Windows
      matrix: windows
  arch:
    - name: ARM
      matrix: arm
    - name: Intel
      matrix: intel
  exclude:
    # This should exclude { os: { name: Windows, matrix: windows }, arch: {name: ARM, matrix: arm } }
    - os:
        matrix: windows
      arch:
        matrix: arm

steps:
  # ERROR: 'run:' is correct
  - ruN: echo "hello"

• Make some RuleBase methods public which are useful to implement your own custom rule type. (thanks @hugo-syn, #327, #331)
• OnRulesCreated field is added to LinterOptions struct. You can modify applied rules with the hook (add your own rule, remove some rule, ...).

• Fix typo in watch webhook's types (thanks @suzuki-shunsuke, #334)
• Add secret_source property to github context. (thanks @asml-mdroogle, #339)
• Many new major releases are added to the popular actions data set (including actions/checkout@v4).

runs-on:
  group: ubuntu-runners
  labels: ubuntu-20.04-16core

config-variables:
  - DEFAULT_RUNNER
  - DEFAULT_TIMEOUT

- name: Use variables
  run: |
    echo "repository variable : ${{ vars.REPOSITORY_VAR }}"
    echo "organization variable : ${{ vars.ORGANIZATION_VAR }}"
    echo "overridden variable : ${{ vars.OVERRIDE_VAR }}"
    echo "variable from shell environment : $env_var"

• actions/dependency-review-action
• dtolnay/rust-toolchain

# ERROR: This format of 'set-output' workflow command was deprecated
- run: echo '::set-output name=foo::bar'

on:
  workflow_call:
    inputs:
      project:
        type: string
        # OK: The default value is generated dynamically
        default: ${{ github.event.repository.name }}

on:
  workflow_call:
    inputs:
      input1:
        type: string
        # ERROR: `input2` is not defined yet
        default: ${{ inputs.input2 }}
      input2:
        type: string
        # OK: `input1` was already defined above
        default: ${{ inputs.input1 }}

on:
  workflow_call:
    inputs:
      input1:
        type: boolean
      input2:
        type: number
        # ERROR: Boolean value cannot be assigned to number
        default: ${{ inputs.input1 }}

...

env:
  TOPLEVEL: ...

jobs:
  test:
    runs-on: ubuntu-latest
    env:
      # ERROR: 'env' context is not available here
      JOB_LEVEL: ${{ env.TOPLEVEL }}
    steps:
      - env:
          # OK: 'env' context is available here
          STEP_LEVEL: ${{ env.TOPLEVEL }}
        ...

test.yaml:11:22: context "env" is not allowed here. available contexts are "github", "inputs", "matrix", "needs", "secrets", "strategy". see https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability for more details [expression]
   |
11 |       JOB_LEVEL: ${{ env.TOPLEVEL }}
   |                      ^~~~~~~~~~~~

...

steps:
  # ERROR: 'success()' function is not available here
  - run: echo 'Success? ${{ success() }}'
    # OK: 'success()' function is available here
    if: success()

test.yaml:8:33: calling function "success" is not allowed here. "success" is only available in "jobs.<job_id>.if", "jobs.<job_id>.steps.if". see https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability for more details [expression]
  |
8 |       - run: echo 'Success? ${{ success() }}'
  |                                 ^~~~~~~~~

on: push
run-name: Deploy by @${{ github.actor }}

jobs:
  ...

$ actionlint -format '{{json .}}' test.yaml | jq
[
  {
    "message": "property \"unknown_prop\" is not defined in object type {arch: string; debug: string; name: string; os: string; temp: string; tool_cache: string; workspace: string}",
    "filepath": "test.yaml",
    "line": 7,
    "column": 23,
    "kind": "expression",
    "snippet": "      - run: echo ${{ runner.unknown_prop }}\n                      ^~~~~~~~~~~~~~~~~~~",
    "end_column": 41
  }
]

• This fixes properties of inputs for workflow_dispatch were not case-insensitive.
• This fixes inputs and outputs of local actions were not handled in case-insensitive way.

# .github/workflows/reusable.yaml
on:
  workflow_call:
    inputs:
      INPUT_UPPER:
        type: string
      input_lower:
        type: string
    secrets:
      SECRET_UPPER:
      secret_lower:
...

# .github/workflows/test.yaml
...

jobs:
  caller:
    uses: ./.github/workflows/reusable.yaml
    # Inputs and secrets are case-insensitive. So all the followings should be OK
    with:
      input_upper: ...
      INPUT_LOWER: ...
    secrets:
      secret_upper: ...
      SECRET_LOWER: ...

• Detect missing required inputs/secrets and undefined inputs/secrets at jobs.<job_id>.with and jobs.<job_id>.secrets. See the document for more details.

  # .github/workflows/reusable.yml
  on:
    workflow_call:
      inputs:
        name:
          type: string
          required: true
      secrets:
        password:
          required: true
  ...
  
  # .github/workflows/test.yml
  ...
  
  jobs:
    missing-required:
      uses: ./.github/workflows/reusable.yml
      with:
        # ERROR: Undefined input "user"
        user: rhysd
        # ERROR: Required input "name" is missing
      secrets:
        # ERROR: Undefined secret "credentials"
        credentials: my-token
        # ERROR: Required secret "password" is missing
  

• Type check for reusable workflow inputs at jobs.<job_id>.with. Types are defined at on.workflow_call.inputs.<name>.type in reusable workflow. actionlint checks types of expressions in workflow calls. See the document for more details.

  # .github/workflows/reusable.yml
  on:
    workflow_call:
      inputs:
        id:
          type: number
        message:
          type: string
  ...
  
  # .github/workflows/test.yml
  ...
  
  jobs:
    type-checks:
      uses: ./.github/workflows/reusable.yml
      with:
        # ERROR: Cannot assign string value to number input. format() returns string value
        id: ${{ format('runner name is {0}', runner.name) }}
        # ERROR: Cannot assign null to string input. If you want to pass string "null", use ${{ 'null' }}
        message: null
  

• Detect local reusable workflow which does not exist at jobs.<job_id>.uses. See the document for more details.

  jobs:
    test:
      # ERROR: This workflow file does not exist
      with: ./.github/workflows/does-not-exist.yml
  

• Check needs.<job_id>.outputs.<output_id> in downstream jobs of workflow call jobs. The outputs object is now typed strictly based on on.workflow_call.outputs.<name> in the called reusable workflow. See the document for more details.

  # .github/workflows/get-build-info.yml
  on:
    workflow_call:
      outputs:
        version:
          value: ...
          description: version of software
  ...
  
  # .github/workflows/test.yml
  ...
  
  jobs:
    # This job's outputs object is typed as {version: string}
    get_build_info:
      uses: ./.github/workflows/get-build-info.yml
    downstream:
      needs: [get_build_info]
      runs-on: ubuntu-latest
      steps:
        # OK. `version` is defined in the reusable workflow
        - run: echo '${{ needs.get_build_info.outputs.version }}'
        # ERROR: `tag` is not defined in the reusable workflow
        - run: echo '${{ needs.get_build_info.outputs.tag }}'
  

• github.action_status
• runner.debug
• services.<service_id>.ports