jdx/jactionlint v2.6.0 on GitHub

jactionlint 2.6.0 adds jactionlint update, which finds newer releases of the actions and reusable workflows you use and can pin them to commit SHAs. This release also fixes jactionlint run --container for containers whose platform differs from the host, and the action can now download jactionlint with a token so it isn't hit by GitHub's limits on anonymous downloads.

Added

`jactionlint update`: update actions and pin to SHAs

jactionlint update checks the external actions and reusable workflows in your workflows and action.yml files. It finds the latest release your policy allows, then lists, previews or writes the new references. It is separate from --fix, so a lint run never changes a version. Use it locally, in a hook or as a CI check. Use Dependabot or Renovate if you want pull requests instead. (#335, @jdx)

jactionlint update              # list available updates, change nothing
jactionlint update --check      # exit 1 on an update, a policy violation or an unverifiable reference
jactionlint update --diff       # unified diff, change nothing
jactionlint update --apply      # write the changes

Policy. Set the policy in a new update: section of the config file, or with command-line options, which override the config:
```
# .github/jactionlint.yaml
update:
  cooldown-days: 7
  freeze: true
  include-tags: "v*"
  exclude-tags: ["*-{alpha,beta,rc}*"]
  exclude-prereleases: true
  require-immutable-releases: true
```
The matching options are --min-age, --freeze, --include-tag and --exclude-tag. Other options: --pin-only pins the current release without upgrading it, --branch-to-tag REGEX converts branch refs such as @main to the latest release, --include-action/--exclude-action filter by action, and --action-rule REGEX=ignore|cooldown:DAYS sets a policy for specific actions.
Safety. It never moves a reference to an older version. If a newer release is held back by the cooldown, it says so. Before updating a pinned SHA, it checks the SHA and its version comment against the repository's tags. It edits only the ref and the version in the comment, and keeps quotes, indentation, line endings and comments that are still true. A line it can't edit without guessing is reported and left as is. A failed lookup is reported as update-unverified and never counted as up to date.
Output. Findings have the IDs update-available, update-policy, update-unverified and update-held, and work with every --format, including SARIF. They aren't linter rules, so --ignore, ignores and ignore comments don't apply to them. Use --exclude-action, --action-rule or --changed-since to leave references out. update always uses the online settings (token, cache, GHES, github.com fallback).
Actions lock file. If .github/workflows/actions.lock exists, --apply ends by running gh actions-lock --relock from the repository root, even when no reference changed. The listing, --check and --diff never run it. If gh or the extension is missing, or the relock fails, update exits 3. Workflow edits made before that point stay written. (#341, @jdx)

See the update guide for details.

Authenticated release downloads

When JACTIONLINT_TOKEN is set, download-jactionlint.bash sends it with the release download request to github.com. It is never sent to the redirect host. The GitHub Action passes its token input to the script, which is github.token by default. On GitHub Enterprise Server, the action doesn't pass the token. Without the variable, downloads work without credentials as before. (#346, @jdx, @joschi)

Fixed

jactionlint run --container now uses the container's platform instead of the host's. Before, JavaScript actions (setup-*, actions/github-script, jdx/mise-action) failed with an exec format error when run from a Mac or in a container of another architecture. The platform comes from --platform, then DOCKER_DEFAULT_PLATFORM, then the image's own platform. Each container platform gets its own tool cache and matching Node.js build, and a node on the host's PATH is never used inside a container. runner.os, runner.arch, RUNNER_OS and RUNNER_ARCH now report the container's platform, so steps under if: runner.os == 'Linux' run instead of being skipped. runner.temp and runner.tool_cache, which were empty before, now match RUNNER_TEMP and RUNNER_TOOL_CACHE. (#344, @jdx)
unpinned-tools (pedantic) no longer reports go install tool, which installs the tools at the versions fixed by go.mod and go.sum. Bare all, std and cmd are no longer reported either. go install example.com/x without a version is still reported. (#338, @ktsu2i)
Binaries are now built with Go 1.27.4, which fixes GO-2026-6859, an net/http server crash. (#345, @jdx)

New Contributors

@ktsu2i made their first contribution in #338
@joschi made their first contribution in #346 (originally #342)

Full Changelog: v2.5.0...v2.6.0

💚 Sponsor jactionlint

jactionlint is a fork of rhysd/actionlint, maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If jactionlint has a place in your development workflow, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep jactionlint fast, free, and independent.

jdx/jactionlint v2.6.0 v2.6.0: `jactionlint update` checks and applies action updates, with optional SHA pinning on GitHub