fix(deps): update module github.com/rhysd/actionlint to v1.7.12 - autoclosed by renovate[bot] · Pull Request #17 · xing/actionlint

renovate · 2023-03-17T04:02:11Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/rhysd/actionlint	`v1.6.22` → `v1.7.12`

Release Notes

rhysd/actionlint (github.com/rhysd/actionlint)

`v1.7.12`

Compare Source

Support the timezone configuration in on.schedule with checks for IANA timezone string. See the documentation for more details. Note that actionlint starts to embed the timezone database in the executables from this version so the binary sizes slightly increase. (#641, thanks @martincostello)
```
on:
  schedule:
    # ERROR: The timezone is not a valid IANA timezone string
    - cron: '*/5 * * * *'
      timezone: 'Asia/Somewhere'
```
Support the jobs.<job_name>.environment.deployment configuration. (#639, thanks @springmeyer)
Support the macos-26-intel runner label. (#629, thanks @hugovk)
Fix the table of webhook activity types are outdated by rebuilding the script to scrape the table from scratch.
Support Go 1.26 and drop the support for Go 1.24. Now supported versions are 1.25 and 1.26.
Tests are run on arm64 Windows in CI.
Update the popular actions data set to the latest.

[Changes][v1.7.12]

`v1.7.11`

Compare Source

Support the case() function in ${{ }} expressions which was recently added to GitHub Actions. (#612, #614, thanks @heppu)

env:
  # ERROR: case() requires an odd number of arguments
  ENVIRONMENT: |-
    ${{ case(
      github.ref == 'refs/heads/main', 'production',
      github.ref == 'refs/heads/staging', 'staging'
    ) }}

Support new macos-26-large and windows-2025-vs2026 runner labels. See the GitHub's announce for more details. (#615, thanks @hugovk and @muzimuzhi)

Enable Artifact attestations for the released binaries. From v1.7.11 gh command can verify the integrity of the downloaded binaries as follows. The verification is highly recommended in terms of supply chain security. (#608, thanks @takaram)

$ gh release download --repo rhysd/actionlint --pattern '*_darwin_amd64.tar.gz' v1.7.11
$ gh attestation verify --repo rhysd/actionlint actionlint_1.7.11_darwin_amd64.tar.gz
Loaded digest sha256:17ffc17fed8f0258ef6ad4aed932d3272464c7ef7d64e1cb0d65aa97c9752107 for file://actionlint_1.7.11_darwin_amd64.tar.gz
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/rhysd
- Source Repository URI must match:......... https://github.com/rhysd/actionlint
- Subject Alternative Name must match regex: (?i)^https://github.com/rhysd/actionlint/
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

The following 1 attestation matched the policy criteria

- Attestation #&#8203;1
  - Build repo:..... rhysd/actionlint
  - Build workflow:. .github/workflows/release.yaml@refs/tags/v1.7.11
  - Signer repo:.... rhysd/actionlint
  - Signer workflow: .github/workflows/release.yaml@refs/tags/v1.7.11

Report path filters with ./ as error because they never match anything. (#521)

on:
  push:
    paths:
      # ERROR: This never matches anything. `foo/bar.txt` is correct.
      - ./foo/bar.txt

Fix comparing matrix items when an item is a super set of another item. (#523, #613, thanks @michaelgruenewald)
Fix stack overflow crash by a recursive anchor in matrix items. (#610)
Fix an unassigned variable false positive from shellcheck by disabling SC2153 rule. (#573)
Reduce the number of memory allocations on resolving anchors.
Update the popular actions data set to the latest.
Update Go dependencies to the latest.
Remove legacy Homebrew formula in rhysd/actionlint repository in favor of the cask package. Note that this change does not affect Homebrew's official formula.
Add a link to the release page of the version in the playground.

[Changes][v1.7.11]

`v1.7.10`

Compare Source

Support YAML anchors and aliases (&anchor and *anchor) in workflow files. In addition to parsing YAML anchors correctly, actionlint checks unused and undefined anchors. See the document for more details. (#133, thanks @srz-zumix for the initial implementation at #568 and @alexaandru for trying another approach at #557)

jobs:
  test:
    runs-on: ubuntu-latest
    services:
      nginx:
        image: nginx:latest
        credentials: &credentials
          username: ${{ secrets.user }}
          password: ${{ secrets.password }}
    steps:
      - run: ./download.sh
        # OK: Valid alias to &credentials
        env: *credentials
      - run: ./check.sh
        # ERROR: Undefined anchor 'credential'
        env: *credential
      - run: ./upload.sh
        # ERROR: Unused anchor 'credentials'
        env: &credentials

Remove support for *-xl macOS runner labels because they were dropped. (#592, thanks @muzimuzhi)
Remove support for the macOS 13 runner labels because they were dropped on Dec 4, 2025. (#593, thanks @muzimuzhi)
- macos-13
- macos-13-large
- macos-13-xlarge
Increase the maximum number of inputs in the workflow_dispatch event from 10 to 25 because the limitation was recently relaxed. (#598, thanks @Haegi)
Support artifact-metadata permission for workflow permissions. (#602, thanks @martincostello)
Detect more complicated constants at if: conditions as error. See the rule document for more details.
Refactor the workflow parser with Go iterators. This slightly improves the performance and memory usage.
Fix parsing extra { and } characters in format string of format() function call. For example v1.7.9 didn't parse "{{0} {1} {2}}" correctly.
Detect an invalid value at type in workflow call inputs as error.
Report YAML merge key << as error because GitHub Actions doesn't support the syntax.

Check available contexts in expressions at jobs.<job_id>.snapshot.if.

snapshot:
  image-name: my-custom-image
  # ERROR: `env` context is not allowed here
  if: ${{ env.USE_SNAPSHOT == 'true' }}

Fix the instruction to install actionlint with mise in the installation document. (#591, thanks @risu729)
Update the popular actions data set to the latest to include new major versions of the actions.

[Changes][v1.7.10]

`v1.7.9`

Compare Source

Add support for ubuntu-slim runner label. (#585, thanks @cestorer)
Check input deprecation in action by checking deprecationMessage property. Using a deprecated input is reported as error if it is not marked as required. See the document for more details. (#580)
```
- uses: reviewdog/action-actionlint@v1
  with:
    # ERROR: Using a deprecated input
    fail_on_error: true
```

Add support for the Custom images feature.

Support image_version workflow trigger.

on:
  image_version:
    names:
      - "MyNewImage"
      - "MyOtherImage"
    versions:
      - 1.*
      - 2.*

Support jobs.<job_id>.snapshot syntax. To make actionlint recognize your own image generation runner, use self-hosted-runner.labels config.

jobs:
  build:
    runs-on: my-image-generation-runner
    snapshot:
        image-name: my-custom-image
        version: 2.*

Fix some invalid permissions are not reported as error in id-token and models scopes. (#582, thanks @holtkampjs)
Fix args and entrypoint inputs are not recognized at uses: when it's not a Docker action. (#550)
Set correct column in source position of YAML parse error.
Fix credentials cannot be configured with ${{ }}. (#590)
Improve messages in syntax errors on parsing steps (run: and uses:). Available keys suggestion is now more accurate and unexpected keys are detected more accurately.
Fix the order of errors can be non-deterministic when multiple errors are caused at the same source positions.
Improve error messages showing suggestions on detecting invalid permissions.
Add instruction for installing actionlint with mise package manager. (#589, thanks @jylenhof)
Fix outdated URLs in the document.
Add new actionlint.AllContexts map constant in Go API that contains the information about all context availability.
Update popular actions data set to the latest with several major versions of actions and the following new actions.
- anthropics/claude-code-action
- openai/codex-action
- google-github-actions/run-gemini-cli
Add make cov task to easily generate a code coverage report.
Make installing the formula version of actionlint pacakge from tap of this repository with Homebrew a hard error. Install the cask version instead following the instruction in the error message.

[Changes][v1.7.9]

`v1.7.8`

Compare Source

Support models permission in permissions section. (#531, thanks @muzimuzhi)
Support job.check_run_id property. (#576, thanks @muzimuzhi for fixing the type at #577)
Support node24 runtime at using section in action metadata. (#561, thanks @salmanmkc)
Add support for the following runner labels
- macos-26 and macos-26-large (#572, thanks @muzimuzhi)
- macos-15 (#572, thanks @muzimuzhi)
Drop support for the following runner labels.
- ubuntu-20.04 (#534, thanks @shogo82148)
- windows-2019 (#572, thanks @muzimuzhi)
Support deprecationMessage in action inputs. (#540, thanks @saansh45)
Support windows-11-arm runner. (#542, thanks @trim21)
Handle ubuntu-latest runner label as ubuntu-24.04 and macos-latest runner label as macos-15.
Report mixing Intel Mac labels and Arm Mac labels as error.
Add new types to issues and pull_request_target webhooks.
Update the popular actions data set to the latest and add more actions to it (thanks @sethvargo for fixing the go generate scripts)
- actions/create-github-app-token
- actions/attest-sbom
- actions/ai-inference
- peter-evans/create-or-update-comment
- release-drafter/release-drafter
- SamKirkland/FTP-Deploy-Action
Fix the version value in actionlint -version can be empty.
Fix outdated URL links in some error messages and documents.
Homebrew formula in this repository is deprecated and Homebrew cask is newly added instead because GoReleaser no longer supports Homebrew formula update. Note that Homebrew's official actionlint formula is still maintained. Please read the documentation for more details.
Drop support for Go 1.23 and earlier because they are no longer maintained officially. Go 1.24 and later are supported to build actionlint.
Replace go-yaml/yaml@v3 package with yaml/go-yaml@v4 package. go-yaml/yaml was used for parsing workflow files however it was unmaintained. yaml/go-yaml is a successor of the library officially maintained by YAML organization. (#575)
Improve error messages on parsing workflow and action metadata files.

[Changes][v1.7.8]

`v1.7.7`

Compare Source

Support runner labels for Linux arm64 hosted runners. (#503, #504, thanks @martincostello)
- ubuntu-24.04-arm
- ubuntu-22.04-arm
Update Go dependencies to the latest.
Update the popular actions data set to the latest.
Add Linux arm64 job to our CI workflow. Now actionlint is tested on the platform. (#507, thanks @cclauss)

[Changes][v1.7.7]

`v1.7.6`

Compare Source

Fix using contexts at specific workflow keys is incorrectly reported as not allowed. Affected workflow keys are as follows. (#495, #497, #498, #500)
- jobs.<job_id>.steps.with.args
- jobs.<job_id>.steps.with.entrypoint
- jobs.<job_id>.services.<service_id>.env
Update Go dependencies to the latest.

[Changes][v1.7.6]

`v1.7.5`

Compare Source

Strictly check available contexts in ${{ }} placeholders following the 'Context availability' table in the official document.

For example, jobs.<job_id>.defaults.run.shell allows env context but shell workflow keys in other places allow no context.

defaults:
  run:
    # ERROR: No context is available here
    shell: ${{ env.SHELL }}

jobs:
  test:
    runs-on: ubuntu-latest
    defaults:
      run:
        # OK: 'env' context is available here
        shell: ${{ env.SHELL }}
    steps:
      - run: echo hello
        # ERROR: No context is available here
        shell: ${{ env.SHELL}}

Check a string literal passed to fromJSON() call. This pattern is popular to create array or object constants because GitHub Actions does not provide the literal syntax for them. See the document for more details. (#464)

jobs:
  test:
    # ERROR: Key 'mac' does not exist in the object returned by the fromJSON()
    runs-on: ${{ fromJSON('{"win":"windows-latest","linux":"ubuntul-latest"}')['mac'] }}
    steps:
      - run: echo This is a special branch!
        # ERROR: Broken JSON string passed to fromJSON.
        if: contains(fromJSON('["main","release","dev"'), github.ref_name)

Allow passing command arguments to -shellcheck argument. (#483, thanks @anuraaga)
- This is useful when you want to use alternative build of shellcheck like go-shellcheck.
```
actionlint -shellcheck="go run github.com/wasilibs/go-shellcheck/cmd/shellcheck@latest"
```
Support undocumented repository_visibility, artifact_cache_size_limit, step_summary, output, state properties in github context. (#489, thanks @rasa for adding repository_visibility property)
Remove macos-12 runner label from known labels because it was dropped from GitHub-hosted runners on Dec. 3 and is no longer available.
Add windows-2025 runner label to the known labels. The runner is in public preview. (#491, thanks @ericcornelissen)
Add black to the list of colors for branding.color action metadata. (#485, thanks @eifinger)
Add table to the list of icons for branding.icon action metadata.
Fix parsing escaped { in format() function call's first argument.
Fix the incorrect join() function overload. join(s1: string, s2: string) was wrongly accepted.
Update popular actions data set to the latest.
- Add download-artifact/v3-node20 to the data set. (#468)
- Fix missing the reviewdog/action-hadolint@v1 action input. (#487, thanks @mi-wada)
Link to the documents of the stable version in actionlint man page and -help output.
Refactor LintStdin() API example and some unit tests. (#472, #475, thanks @alexandear)
Improve the configuration example in actionlint.yaml document to explain glob patterns for paths. (#481)

[Changes][v1.7.5]

`v1.7.4`

Compare Source

Disallow the usage of popular actions that run on node16 runner. The node16 runner will reach the end of life on November 12.
- In case of the error, please update your actions to the latest version so that they run on the latest node20 runner.
- If you're using self-hosted runner and you cannot upgrade your runner to node20 soon, please consider to ignore the error by the paths configuration described below.
- If you're using actions/upload-artifact@v3 and actions/download-artifact@v3 on GHES, please replace them with actions/upload-artifact@v3-node20 and actions/download-artifact@v3-node20. (#468)

Provide the configuration for ignoring errors by regular expressions in actionlint.yml (or actionlint.yaml). Please see the document for more details. (#217, #342)

The paths is a mapping from the file path glob pattern to the corresponding configuration. The ignore configuration is a list of regular expressions to match error messages (similar to the -ignore command line option).

paths:
  # This pattern matches any YAML file under the '.github/workflows/' directory.
  .github/workflows/**/*.yaml:
    ignore:
      # Ignore the specific error from shellcheck
      - 'shellcheck reported issue in this script: SC2086:.+'
  # This pattern only matches '.github/workflows/release.yaml' file.
  .github/workflows/release.yaml:
    ignore:
      # Ignore errors from the old runner check. This may be useful for (outdated) self-hosted runner environment.
      - 'the runner of ".+" action is too old to run on GitHub Actions'

This configuration was not implemented initially because I wanted to keep the configuration as minimal as possible. However, due to several requests for it, the configuration has now been added.

Untrusted inputs check is safely skipped inside specific function calls. (#459, thanks @IlyaGulya)
- For example, the following step contains the untrusted input github.head_ref, but it is safe because it's passed to the contains() argument.
```
- run: echo "is_release_branch=${{ contains(github.head_ref, 'release') }}" >> "$GITHUB_OUTPUT"
```
- For more details, please read the rule document.
Recognize gcr.io and gcr.dev as the correct container registry hosts. (#463, thanks @takaidohigasi)
- Note that it is recommended explicitly specifying the scheme like docker://gcr.io/....
Remove macos-x.0 runner labels which are no longer available. (#452)
Disable shellcheck SC2043 rule because it can cause false positives on checking run:. (#355)
- The rule document was updated as well. (#466, thanks @risu729)
Fix the error message was not deterministic when detecting cycles in needs dependencies.
Fix the check for format() function was not applied when the function name contains upper case like Format(). Note that function names in ${{ }} placeholders are case-insensitive.
Update the popular actions data set to the latest.
- This includes the new ref and commit outputs of actions/checkout.
Add actions/cache/save and actions/cache/restore to the popular actions data set.
Links in the README.md now point to the document of the latest version tag instead of HEAD of main branch.
Add Linter.LintStdin method dedicated to linting STDIN instead of handling STDIN in Command.
(Dev) Add new check-checks script to maintain the 'Checks' document. It automatically updates the outputs and playground links for example inputs in the document. It also checks the document is up-to-date on CI. Please read the document for more details.

Documentation

[Changes][v1.7.4]

`v1.7.3`

Compare Source

Remove macos-11 runner labels because macOS 11 runner was dropped on 6/28/2024. (#451, thanks @muzimuzhi)
Support macos-15, macos-15-large, and macos-15-xlarge runner labels. The macOS 15 runner is not globally available yet, but they are available in beta. (#453, thanks @muzimuzhi)
Release artifact includes checksums for the released binaries. The file name is actionlint_{version}_checksums.txt. (#449)
- For example, the checksums for v1.7.3 can be found here.
Fix download-path output is missing in actions/download-artifact@v3 action. (#442)
- Note that the latest version actions/download-artifact@v4 was not affected by this issue.
Support Go 1.23.

Documentation

[Changes][v1.7.3]

`v1.7.2`

Compare Source

Fix child processes to run in parallel.
Update the popular actions data set to the latest. (#442, #445, #446, #447, thanks @maikelvdh)
Add support for checking branch filters on merge_group event. (#448, thanks @muzimuzhi)
The playground now supports both light and dark modes and automatically applies the system's theme.
Fix releasing a failure on making a new winget package. (#438, thanks @vedantmgoyal9)

[Changes][v1.7.2]

`v1.7.1`

Compare Source

Support the timezone configuration in on.schedule with checks for IANA timezone string. See the documentation for more details. Note that actionlint starts to embed the timezone database in the executables from this version so the binary sizes slightly increase. (#641, thanks @martincostello)
```
on:
  schedule:
    # ERROR: The timezone is not a valid IANA timezone string
    - cron: '*/5 * * * *'
      timezone: 'Asia/Somewhere'
```
Support the jobs.<job_name>.environment.deployment configuration. (#639, thanks @springmeyer)
Support the macos-26-intel runner label. (#629, thanks @hugovk)
Fix the table of webhook activity types are outdated by rebuilding the script to scrape the table from scratch.
Support Go 1.26 and drop the support for Go 1.24. Now supported versions are 1.25 and 1.26.
Tests are run on arm64 Windows in CI.
Update the popular actions data set to the latest.

[Changes][v1.7.12]

`v1.7.0`

Compare Source

From this version, actionlint starts to check action metadata file action.yml (or action.yaml). At this point, only very basic checks are implemented and contents of steps: are not checked yet.
- It checks properties under runs: section (e.g. main: can be specified when it is a JavaScript action), branding: properties, and so on.
```
name: 'My action'
author: '...'
# ERROR: 'description' section is missing

branding:
  # ERROR: Invalid icon name
  icon: dog

runs:
  # ERROR: Node.js runtime version is too old
  using: 'node12'
  # ERROR: The source file being run by this action does not exist
  main: 'this-file-does-not-exist.js'
  # ERROR: 'env' configuration is only allowed for Docker actions
  env:
    SOME_VAR: SOME_VALUE
```
- actionlint still focuses on checking workflow files. So there is no way to directly specify action.yml as an argument of actionlint command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead.
- Checks for steps: contents are planned to be implemented. Since several differences are expected between steps: in workflow file and steps: in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected.

Add runner.environment property. (#412)

- run: echo 'Run by GitHub-hosted runner'
  if: runner.environment == 'github-hosted'

Using outdated popular actions is now detected at error. See the document for more details.
- Here 'outdated' means actions which use runtimes no longer supported by GitHub-hosted runners such as node12.
```
# ERROR: actions/checkout@v2 is using the outdated runner 'node12'
- uses: actions/checkout@v2
```
Support attestations permission which was recently added to GitHub Actions as beta. (#418, thanks @bdehamer)
```
permissions:
  id-token: write
  contents: read
  attestations: write
```

Check comparison expressions more strictly. Arbitrary types of operands can be compared as the official document explains. However, comparisons between some types are actually meaningless because the values are converted to numbers implicitly. actionlint catches such meaningless comparisons as errors. Please see the check document for more details.

on:
  workflow_call:
    inputs:
      timeout:
        type: boolean

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - run: echo 'called!'
        # ERROR: Comparing string to object is always evaluated to false
        if: ${{ github.event == 'workflow_call' }}
      - run: echo 'timeout is too long'
        # ERROR: Comparing boolean value with `>` doesn't make sense
        if: ${{ inputs.timeout > 60 }}

Follow the update that macos-latest is now an alias to macos-14 runner.
Support a custom python shell by pyflakes rule.
Add workaround actionlint reports that dorny/paths-filter's predicate-quantifier input is not defined. (#416)
Fix the type of a conditional expression by comparison operators is wider than expected by implementing type narrowing. (#384)
- For example, the type of following expression should be number but it was actually string | number and actionlint complained that timeout-minutes must take a number value.
```
timeout-minutes: ${{ env.FOO && 10 || 60 }}
```

Fix ${{ }} placeholder is not available at jobs.<job_id>.services. (#402)

jobs:
  test:
    services: ${{ fromJSON('...') }}
    runs-on: ubuntu-latest
    steps:
      - run: ...

Do not check outputs of google-github-actions/get-secretmanager-secrets because this action sets outputs dynamically. (#404)

Fix defaults.run is ignored on detecting the shell used in run:. (#409)

defaults:
  run:
    shell: pwsh
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      # This was wrongly detected as bash script
      - run: $Env:FOO = "FOO"

Fix parsing a syntax error reported from pyflakes when checking a Python script in run:. (#411)
```
- run: print(
  shell: python
```

Skip checking exclude: items in matrix: when they are constructed from ${{ }} dynamically. (#414)

matrix:
  foo: ['a', 'b']
  exclude:
    # actionlint complained this value didn't exist in matrix combinations
    - foo: ${{ env.EXCLUDE_FOO }}

Fix checking exclude: items when ${{ }} is used in nested arrays at matrix items.

matrix:
  foo:
    - ["${{ fromJSON('...') }}"]
  exclude:
    # actionlint complained this value didn't match to any matrix combinations
    - foo: ['foo']

Update popular actions data set. New major versions are added and the following actions are newly added.
- peaceiris/actions-hugo
- actions/attest-build-provenance
- actions/add-to-project
- octokit/graphql-action
Update Go dependencies to the latest.
Reduce the size of actionlint executable by removing redundant data from popular actions data set.
- x86_64 executable binary size was reduced from 6.9MB to 6.7MB (2.9% smaller).
- Wasm binary size was reduced from 9.4MB to 8.9MB (5.3% smaller).
Describe how to integrate actionlint to Pulsar Edit in the document. (#408, thanks @mschuchard)
Update outdated action versions in the usage document. (#413, thanks @naglis)

[Changes][v1.7.0]

`v1.6.27`

Compare Source

Add macOS 14 runner labels for Apple Silicon support. The following labels are added. (thanks @harryzcy, #392)
- macos-14
- macos-14-xlarge
- macos-14-large
Remove ubuntu-18.04 runner label from runners list since it is no longer supported. (#363)
Allow glob patterns in self-hosted-runner.labels configuration. For example, the following configuration defines any runner labels prefixed with private-linux-. (thanks @kishaningithub, #378)
```
self-hosted-runner:
  labels:
    - private-linux-*
```
Fix a race condition bug when -format option is used for linting multiple workflow files. Thanks @ReinAchten-TomTom for your help on the investigation. (#370)
Fix a race condition due to conflicts between some goroutine which starts to run shellcheck process and other goroutine which starts to wait until all processes finish.
The popular actions data set was updated to the latest and the following actions were newly added. (thanks @jmarshall, #380)
- google-github-actions/auth
- google-github-actions/get-secretmanager-secrets
- google-github-actions/setup-gcloud
- google-github-actions/upload-cloud-storage
- pulumi/actions
- pypa/gh-action-pypi-publish
Add support for larger runner labels. The following labels are added. (thanks @therealdwright, #371)
- windows-latest-8-cores
- ubuntu-latest-4-cores
- ubuntu-latest-8-cores
- ubuntu-latest-16-cores
The following WebHook types are supported for pull_request event.
- enqueued
- dequeued
- milestoned
- demilestoned
Explain how to control shellckeck behavior in the shellcheck rule document. Use SHELLCHECK_OPTS environment variable to pass arguments to shellcheck. See the shellcheck's official document for more details.
```
# Enable some optional rules
SHELLCHECK_OPTS='--enable=avoid-nullary-conditions' actionlint
# Disable some rules
SHELLCHECK_OPTS='--exclude=SC2129' actionlint
```
Explicitly specify docker.io host name in pre-commit hook. (thanks @gotmax23, #382)
Explain how to report issues and send patches in CONTRIBUTING.md.
Fix the link to super-linter project. (thanks @zkoppert, #376)
Add the instruction to install actionlint via the Arch Linux's official repository. (thanks @sorairolake, #381)
Prefer fixed revisions in the pre-commit usage. (thanks @corneliusroemer, #354)
Add instructions to use actionlint with Emacs. (thanks @tirimia, #341)
Add instructions to use actionlint with Vim and Neovim text editors.
Add actionlint.RuleBase.Config method to get the actionlint configuration passed to rules. (thanks @hugo-syn, #387)
Add actionlint.ContainsExpression function to check if the given string contains ${{ }} placeholders or not. (thanks @hugo-syn, #388)
Support Go 1.22 and set the minimum supported Go version to 1.18 for x/sys package.
Update Go dependencies to the latest.

[Changes][v1.6.27]

`v1.6.26`

Compare Source

Several template fields and template actions were added. All fields and actions are listed in the document. Please read it for more details. (#311)
- By these additions, now actionlint can output the result in the SARIF format. SARIF is a format for the output of static analysis tools used by GitHub CodeQL. the example Go template to format actionlint output in SARIF.
```
actionlint -format "$(cat /path/to/sarif_template.txt)" > output.json
```
- allKinds returns the kinds (lint rules) information as an array. You can include what lint rules are defined in the command output.
- toPascalCase converts snake case (foo_bar) or kebab case (foo-bar) into pascal case (FooBar).

Report an error when the condition at if: is always evaluated to true. See the check document to know more details. (#272)

# ERROR: All the following `if:` conditions are always evaluated to true
- run: echo 'Commit is pushed'
  if: |
    ${{ github.event_name == 'push' }}
- run: echo 'Commit is pushed'
  if: "${{ github.event_name == 'push' }} "
- run: echo 'Commit is pushed to main'
  if: ${{ github.event_name == 'push' }} && ${{ github.ref_name == 'main' }}

Fix actionlint didn't understand ${{ }} placeholders in environment variable names. (#312)
```
env:
  "${{ steps.x.outputs.value }}": "..."
```

Fix type of matrix row when some expression is assigned to it with ${{ }} (#285)

strategy:
  matrix:
    test:
      # Matrix rows are assigned from JSON string
      - ${{ fromJson(inputs.matrix) }}
steps:
  - run: echo ${{ matrix.test.foo.bar }}

Fix checking exclude of matrix was incorrect when some matrix row is dynamically constructed with ${{ }}. (#261)

strategy:
  matrix:
    build-type:
      - debug
      - ${{ fromJson(inputs.custom-build-type) }}
    exclude:
      # 'release' is not listed in 'build-type' row, but it should not be reported as error
      # since the second row of 'build-type' is dynamically constructed with ${{ }}.
      - build-type: release

Fix checking exclude of matrix was incorrect when object is nested at row of the matrix. (#249)

matrix:
  os:
    - name: Ubuntu
      matrix: ubuntu
    - name: Windows
      matrix: windows
  arch:
    - name: ARM
      matrix: arm
    - name: Intel
      matrix: intel
  exclude:
    # This should exclude { os: { name: Windows, matrix: windows }, arch: {name: ARM, matrix: arm } }
    - os:
        matrix: windows
      arch:
        matrix: arm

Fix data race when actionlint.yml config file is used by multiple goroutines to check multiple workflow files. (#333)

Check keys' case sensitivity. (#302)

steps:
  # ERROR: 'run:' is correct
  - ruN: echo "hello"

Add number as input type of workflow_dispatch event. (#316)
Check max number of inputs of workflow_dispatch event is 10.
Check numbers at timeout-minutes and max-parallel are greater than zero.
Add Go APIs to define a custom rule. Please read the code example to know the usage.
- Make some RuleBase methods public which are useful to implement your own custom rule type. (thanks @hugo-syn, #327, #331)
- OnRulesCreated field is added to LinterOptions struct. You can modify applied rules with the hook (add your own rule, remove some rule, ...).
Add NewProject() Go API to create a Project instance.
Fix tests failed when sources are downloaded from .tar.gz link. (#307)
Improve the pre-commit document to explain all pre-commit hooks by this repository.
Clarify the regular expression syntax of -ignore option is RE2. (#320)
Use ubuntu-latest runner to create winget release. (thanks @sitiom, #308)
Update popular actions data set, available contexts, webhook types to the latest.
- Fix typo in watch webhook's types (thanks @suzuki-shunsuke, #334)
- Add secret_source property to github context. (thanks @asml-mdroogle, #339)
- Many new major releases are added to the popular actions data set (including actions/checkout@v4).
Use Go 1.21 to build release binaries.
Update Go dependencies to the latest. (thanks @harryzcy, #322)

[Changes][v1.6.26]

`v1.6.25`

Compare Source

Parse new syntax at runs-on:. Now runs-on: can have group: and labels: configurations. Please read the official document for more details. ([#280](https://redirect.github

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2024-09-23T18:51:08Z

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.19` -> `1.24.0`
`github.com/fatih/color`	`v1.13.0` -> `v1.18.0`
`github.com/mattn/go-colorable`	`v0.1.13` -> `v0.1.14`
`github.com/mattn/go-isatty`	`v0.0.16` -> `v0.0.20`
`github.com/mattn/go-runewidth`	`v0.0.13` -> `v0.0.17`

renovate · 2025-12-15T16:48:20Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.19` -> `1.25.0`
`github.com/fatih/color`	`v1.13.0` -> `v1.19.0`
`github.com/mattn/go-colorable`	`v0.1.13` -> `v0.1.14`

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.6.23~~ fix(deps): update module github.com/rhysd/actionlint to v1.6.24 Apr 17, 2023

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from 59d4424 to 47ec7b0 Compare April 17, 2023 12:18

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.6.24~~ fix(deps): update module github.com/rhysd/actionlint to v1.6.25 Jun 15, 2023

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from 47ec7b0 to 9d4bf4e Compare June 15, 2023 17:35

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.6.25~~ fix(deps): update module github.com/rhysd/actionlint to v1.6.26 Sep 18, 2023

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from 9d4bf4e to b927103 Compare September 18, 2023 16:49

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.6.26~~ fix(deps): update module github.com/rhysd/actionlint to v1.6.27 Feb 24, 2024

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from b927103 to 66932da Compare February 24, 2024 15:31

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.6.27~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.0 May 8, 2024

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from 66932da to 3148f3f Compare May 8, 2024 18:03

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from 3148f3f to e29c76f Compare May 28, 2024 14:53

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.7.0~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.1 May 28, 2024

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from e29c76f to 9b0f449 Compare September 23, 2024 18:51

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.7.1~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.2 Sep 23, 2024

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from 9b0f449 to 8214054 Compare September 29, 2024 15:55

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.7.2~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.3 Sep 29, 2024

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.7.3~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.4 Nov 4, 2024

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from 8214054 to f591308 Compare November 4, 2024 14:05

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from f591308 to 37ee6b8 Compare December 28, 2024 13:35

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.7.4~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.5 Dec 28, 2024

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from 37ee6b8 to df2cd4d Compare January 4, 2025 16:28

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.7.5~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.6 Jan 4, 2025

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from df2cd4d to fd8a878 Compare January 19, 2025 13:40

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.7.6~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.7 Jan 19, 2025

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from fd8a878 to 849ce81 Compare October 11, 2025 13:04

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.7.7~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.8 Oct 11, 2025

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from 849ce81 to f160b26 Compare November 21, 2025 08:31

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.7.8~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.9 Nov 21, 2025

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from f160b26 to bfa1ef4 Compare December 30, 2025 18:52

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.7.9~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.10 Dec 30, 2025

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from bfa1ef4 to e707869 Compare February 14, 2026 12:35

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.7.10~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.11 Feb 14, 2026

fix(deps): update module github.com/rhysd/actionlint to v1.7.12

2b522e3

renovate Bot force-pushed the renovate/github.com-rhysd-actionlint-1.x branch from e707869 to 2b522e3 Compare March 30, 2026 21:43

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.7.11~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.12 Mar 30, 2026

renovate Bot changed the title ~~fix(deps): update module github.com/rhysd/actionlint to v1.7.12~~ fix(deps): update module github.com/rhysd/actionlint to v1.7.12 - autoclosed Jul 13, 2026

renovate Bot closed this Jul 13, 2026

renovate Bot deleted the renovate/github.com-rhysd-actionlint-1.x branch July 13, 2026 16:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update module github.com/rhysd/actionlint to v1.7.12 - autoclosed#17

fix(deps): update module github.com/rhysd/actionlint to v1.7.12 - autoclosed#17
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-rhysd-actionlint-1.x

renovate Bot commented Mar 17, 2023 •

edited

Loading

Uh oh!

renovate Bot commented Sep 23, 2024 •

edited

Loading

Uh oh!

renovate Bot commented Dec 15, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Mar 17, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Configuration

Uh oh!

renovate Bot commented Sep 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ Artifact update notice

File name: go.mod

Uh oh!

renovate Bot commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Mar 17, 2023 •

edited

Loading

renovate Bot commented Sep 23, 2024 •

edited

Loading

renovate Bot commented Dec 15, 2025 •

edited

Loading