jdx/jactionlint v2.2.0

v2.2.0: New rules, repository-aware CLI modes, and a PyPI package

on GitHub

jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (--changed-since), rule discovery (--list-rules, --explain, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the default or correctness profile, so a run that was clean on 2.1.0 can show new findings. See Changed before you upgrade.

Highlights

• More checks before a run fails: shell syntax errors without shellcheck, JavaScript syntax errors in actions/github-script, job permissions too narrow for the actions in the job, gh without a token, ubuntu-slim limits, github.event property typos, and validation of GitHub's Actions lock file.
• Deeper security analysis: untrusted-checkout, cache-poisoning, template-injection and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers.
• Better for CI and tooling: report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with pip/uvx.

Added

New rules in the default and correctness profiles

• shell-syntax (default, error): reports syntax errors in bash/sh run: scripts, such as an unclosed quote or a missing fi/done, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#273, @jdx)
• insufficient-permissions (default, error): reports a job whose explicit permissions: miss a scope that one of its actions needs (upload-sarif, deploy-pages, OIDC logins, gh release create, git push and others, about 26 entries). missing-permissions --fix now uses the same table to write job-level permissions when the needs are exact. (#192, @jdx)
• ubuntu-slim-limits (default, error): reports container:, services: and Docker container actions in jobs that run only on ubuntu-slim. With pedantic, it also reports timeout-minutes above 15. missing-timeout --fix limits its value to 15 for these jobs. (#190, @jdx)
• actions-lock (default, error) and actions-lock-drift (online): check .github/workflows/actions.lock against the workflows. They report missing, stale and malformed entries. With --online, they also report replaced repositories, moved tags and commits that are on no branch or tag. Repositories without a lock file are not affected. unpinned-uses accepts a ref that the lock file pins to a commit. (#237, #228, @jdx)
• hardcoded-registry-credentials (default, error): reports plain-text passwords, tokens and keys in registries of dependabot.yml, including passwords embedded in a registry URL. (#265, @jdx)
• gh-without-token (correctness): reports a gh command that needs a token in a step where no GH_TOKEN/GITHUB_TOKEN is set. (#177, @jdx)
• environment-file-redirect (correctness): reports writes to GITHUB_OUTPUT (and similar files) without the $, and a > that overwrites data the same script already wrote. It has a fix: safe for the missing $, unsafe for >. (#184, @jdx)
• github-script-syntax (correctness): checks the script input of actions/github-script with node --check. It knows the argument names of each action version, so it catches errors like const glob = require(...). It needs Node.js 20 or later on PATH; without it, the rule is skipped and a note says so. (#242, @jdx)
• malformed-expression-delimiters (correctness): reports ${ github.ref }, $ {{ x }} and {{ github.sha }}. (#180, @jdx)
• multiline-plain-run (correctness): reports a multi-line run: that YAML folds into a single line. (#205, #256, @jdx)
• concurrency-deadlock (correctness): reports a concurrency group that a workflow shares with a local reusable workflow it calls. GitHub cancels such runs as a deadlock. (#210, @jdx)
• conflicting-action-inputs (correctness), plus new missing-action-input cases: report input combinations of well-known actions that cannot work, for example download-artifact name with artifact-ids, or nick-fields/retry without exactly one timeout input. (#207, @jdx)
• undefined-property now checks github.event.* property names against the webhook payloads, down to three levels. By default, it reports only names that no event has. The strict-event-payloads option, on in the pedantic profile, also reports properties that the workflow's own triggers don't have. (#249, @jdx)

New pedantic rules

• deprecated-runner-label: warns about runner labels with an announced retirement date (macos-14, ubuntu-22.04), with replacement labels. (#182)
• deprecated-node-runtime: reports runs.using: node20/16/12 in action metadata, popular actions at majors that declare node20, and environment variables that select the Node.js runtime. (#225, #230, #234)
• command-injection: reports untrusted input that was moved to env: but then runs as code (eval, bash -c, python -c, execSync in github-script, and similar). (#202)
• argument-injection: reports free text in the program of sed/awk, in find -exec, or as a leading word of tar, curl, git clone and others. (#221)
• output-clobbering: reports input that can contain line breaks written to GITHUB_OUTPUT as a single record. (#212)
• comment-trigger-authorization: reports comment-triggered jobs that don't check who commented. (#217)
• event-name-never-received: reports github.event_name compared with an event the workflow never receives. (#214)
• fail-fast-action-inputs: reports actions configured to pass when they produced nothing. (#196)
• macos-gnu-flags: reports GNU-only options in run scripts of macOS jobs. (#241)
• unmatched-paths-filter: reports paths filters that match no file in the repository. (#238)
• missing-version-comment: reports a commit-SHA pin without a version comment. --online --fix adds the comment. (#232)
• unused-workflow-secret: reports on.workflow_call.secrets that nothing reads. (#223)

All by @jdx.

New online rules

• repojacking: reports an action or reusable workflow whose owner name anyone could register. It runs on github.com only. (#248, @jdx)
• unpinnable-action: reports an action pinned by hash whose own dependencies are not pinned. (#240, @jdx)
• action-release-cooldown (opt-in): reports an action at a version released less than N days ago. It is off until the config has an entry for it:

  rules:
    action-release-cooldown: { level: warning, days: 7 }

  (#235, @jdx)

Extensions to existing rules

• untrusted-checkout follows the pull request revision through variables, script files, pull/N/head fetches, local reusable workflows and composite actions. It now covers issue_comment workflows that build a pull request, and reports gates that pass once in front of code that can change. It honors the fork protection of actions/checkout, and counts actions that run the workspace and the input that makes them do it. (#159, #175, #203, #206, #208, #213, #220, @jdx)

• With --online, environments are checked: untrusted-checkout, untrusted-artifact and agentic-actions no longer trust an environment: that has no required reviewers, or that doesn't exist in a public repository. (#247, @jdx)

• cache-poisoning:

  • A build job that uploads artifacts for a publishing job counts as a release job, even with a read-only token.
  • More publishers are recognized, including docker/build-push-action with an expression for push, plus maturin and sccache caches, pnpm/setup, graalvm and composer.
  • Caches of credential files are reported.
  • A new pedantic option adds zizmor's heuristics for tag-triggered and release-branch workflows.

  (#160, #216, @jdx)

• template-injection reports more outsider-controlled free text in the default profile: previous titles and bodies of edited issues, the fork homepage, wiki page titles, merge queue commit messages, and workflow_run paths. (#173, @jdx)

• dangerous-triggers messages say which token scopes the workflow can write and which secrets it reads. (#189, @jdx)

• github-env follows text that a script reads with gh and git. (#218, @jdx)

• unpinned-images checks docker run images in scripts and adds per-image policies and image allow/deny lists. --online --fix=unsafe pins container images to a digest. (#211, #239, @jdx)

• unpinned-uses accepts the tag of an immutable release under --online. --online --fix names the most specific version tag in the comment it writes. (#251, #224, @jdx)

• ref-version-mismatch reads ratchet comments and can fix the version comment (unsafe). (#227, @jdx)

• workflow-secret-scope has a job-level option. secrets-outside-env now reports secrets passed to reusable workflows. (#223, @jdx)

• More pedantic options:

  • unlocked-install reports npm/yarn/bun/aube installs that run lifecycle scripts or have no release-age cooldown.
  • untrusted-artifact knows more download actions and reports downloads of every artifact.
  • use-trusted-publishing reports jobs that build, have no environment, or drop attestations.
  • unredacted-secrets reports values cut from a secret and printed by a script.
  • concurrency-limits reports schedule-only and manual-only workflows.

  (#187, #201, #255, #219, #209, #222, #266, @jdx)

• aube is recognized wherever npm, pnpm, yarn and bun are. (#254, @jdx)

• Runner labels:

  • Labels of Blacksmith, Depot, Namespace, RunsOn, Ubicloud and WarpBuild are accepted. Limit them with self-hosted-runner.providers.
  • Labels built from a matrix value and text are checked.
  • self-hosted-runner counts the configured labels and runner groups, and says when a pull request reaches the runner.

  (#199, #233, #194, @jdx)

• github-app checks two more token actions, and dependabot-missing-actions-update covers local composite actions. (#229, @jdx)

• superfluous-actions resolves runs-on expressions that the repository defines. (#271, @jdx)

• missing-timeout has an accept-step-timeouts option for jobs whose steps all set timeout-minutes. (#252, @jdx)

Online checks

• With --online, the inputs of any remote action outside the built-in data set are checked against its action.yml at the pinned ref. Calls of reusable workflows in other repositories are checked the same way. (#231, #236, @jdx)
• On GitHub Enterprise Server, actions from github.com can be looked up on github.com. (#250, @jdx)
• --online-report=FILE writes online coverage and cache freshness as JSON, for any output format. The SARIF output gets the same fields. (#166, @jdx)

CLI and configuration

• --changed-since REV shows only findings on lines changed since the merge base with REV, for pull request checks. --changed-scope files shows every finding in a changed file. The whole repository and call graph are still analyzed. A missing merge base, for example in a shallow clone, exits with status 3. (#274, #279, @jdx)

  jactionlint --changed-since origin/main

• --select=RULES reports only the named rules. --no-ignores disables inline ignores, config ignores and the baseline. --list-rules lists all rules, also as JSON. (#200, @jdx)
• --explain RULE prints a rule's documentation, options, fix prerequisites and examples, offline. --completion=bash|zsh|fish|powershell prints a shell completion script. (#204, #269, @jdx)
• --show-fix-status shows under each finding whether a fix is available and how to apply it, and more fixable rules say why a finding has no fix. SARIF output explains a missing fix as well. (#269, #164, @jdx)
• --show-doc-urls and --finding-context (events and token permissions on each JSON/SARIF finding) add details to the output. --ruff=CMD checks Python scripts with ruff instead of pyflakes. The config key platform: forgejo|gitea accepts full-URL uses: references to other hosts. Jujutsu (.jj) workspaces are detected as project roots. (#215, @jdx)
• --export-facts prints the events, permissions, concurrency, jobs, steps and calls of a repository as versioned JSON, for jq or policy tools. --print-facts-schema prints its schema. (#272, @jdx)
• --suggest-timeouts reports how long each job took in its latest successful runs and suggests a timeout-minutes value. It is a report only and changes no files. (#275, @jdx)
• JSON Schemas for the config file and for --format json output are available through --print-config-schema and --print-output-schema. --init-config adds a yaml-language-server schema comment. (#195, @jdx)
• A new shellcheck: config section sets rcfile, args and enable. The --shellcheck-rcfile=FILE flag overrides rcfile. (#191, @jdx)
• A note says when shellcheck, pyflakes or node did not run. (#188, @jdx)

Installation

• Wheels are published to PyPI, so jactionlint can be installed with pip, pipx, uv tool or uvx. (#277, @jdx)

  uvx jactionlint

• The pre-commit hooks now also run when action.yml or dependabot.yml changes. A new jactionlint-shellcheck hook builds shellcheck into the hook environment. (#181, @jdx)

Changed

• New findings on existing workflows. The new default and correctness rules above, the new template-injection contexts and the wider cache-poisoning coverage can report on workflows that passed on 2.1.0. actions-lock reports only in repositories with an Actions lock file. Popular actions pinned to a full version, or to a commit with a version comment, now get their inputs checked. (#174, @jdx)

• Stricter syntax checks. These are now reported because GitHub rejects them: a schedule entry without cron, merge_group types other than checks_requested, $/path@ref, $/ paths that leave the repository or don't exist, timeout-minutes in composite steps, unsupported contexts in action input defaults, and expressions in uses:. (#186, @jdx)

• Runner label retirements: unknown-runner-label will start reporting macos-14 on 2026-11-02 and ubuntu-22.04 on 2027-04-17. Each finding names the retirement date and replacement labels. Before those dates, only the pedantic deprecated-runner-label warns. (#182, @jdx)

• Fewer default findings:

  • dangerous-triggers reports a workflow that has no write scopes and reads no secrets only with pedantic. (#189)
  • cache-poisoning reports docker/setup-buildx-action only when version is set. pedantic restores the old behavior. (#160)
  • Hosted-runner provider labels are no longer unknown. (#199)

  All by @jdx.

• A broken extends is now an error. In a discovered config file, an extends entry that points to a missing file exits with status 3. Before, the whole config was silently skipped. (#285, @jdx)

• Ignore comments inside scripts no longer apply. An own-line # jactionlint ignore= inside a run: | block or another multi-line string has no effect. Only real YAML comments are read. (#284, @jdx)

• Go API:

  • NewLinter(out, nil) no longer panics.
  • Error.PrettyPrint prints the rule ID instead of the kind. Error() is unchanged.
  • ExprSemanticsChecker rejects every context unless SetContextAvailability is called.

  (#283, @jdx)

Fixed

• False positives:
  • Keys and values that the workflow schema allows but the docs don't list are accepted. (#170)
  • A whole mapping or list written as one expression is accepted where the schema allows it. (#178)
  • if-always-true no longer reports the trailing newlines of a block scalar. (#226)
• Missing findings:
  • -latest runner labels are matched to the images behind them. (#171)
  • Permission findings of the pedantic profile are reported again. (#176)
  • untrusted-checkout skips merged pull requests and counts sed -f, awk -f, tar -P and unzip -:. (#175)
• --changed-since counts findings that several files share once, keeps ..foo paths inside the repository, and refuses --export-facts. (#279)
• download-jactionlint.bash: a missing release now prints a clear error instead of a gzip error. The script accepts amd64 (FreeBSD), and its help text is corrected. (#282)
• --help and messages: --help and several online and --migrate-ignores messages now match the documented behavior. (#287)

All by @jdx.

Performance

• Peak memory is lower on very large repositories because fewer workflows are checked at the same time. (#158)
• Each run script is analyzed once, the callers of an action are parsed once, and parsed expressions are shared between rules. (#270, #165)
• The --online checks read the advisories of all actions with one request. (#268)

All by @jdx.

Full Changelog: v2.1.0...v2.2.0

💚 Sponsor jactionlint

jactionlint is a fork of rhysd/actionlint, maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If jactionlint has a place in your development workflow, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep jactionlint fast, free, and independent.