actionlint

How it works

actionlint is a Go binary that parses workflow files against the full workflow schema. It type-checks every ${{ }} expression, knows which contexts are available in which keys, and validates inputs for popular actions, runner labels, cron syntax and job dependencies.

Shell in run: steps is passed to ShellCheck and Python steps to pyflakes when those are installed. One check flags untrusted inputs such as github.event.pull_request.title used directly in an inline script, which is the classic script injection.

What it catches

• Syntax and schema errors before a push breaks CI
• Expressions that reference missing contexts or have the wrong type
• Untrusted event fields inside inline scripts
• Shell bugs in run: steps (via ShellCheck)
• Invalid runner labels and needs: graphs

Run it

brew install actionlint
actionlint
# or without installing:
docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:latest

What leaves your machine

Nothing. It reads the workflow files locally.

Limits

• Mostly about correctness. It does not check pinning, permissions or dangerous triggers.
• No SARIF writer; output is text or a Go template you supply.

Links

• Repository: rhysd/actionlint ↗
• List of checks ↗

Related tools