actionlint statically checks GitHub Actions workflow files for mistakes before they run. Used as a workflow step, it can surface configuration problems and flag expressions that may pass untrusted input into scripts. section 3.9 section 6.2
jobs:
main:
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
steps:
- uses: actions/checkout@v3
- uses: devops-actions/actionlint@v0.1.2
Add actionlint after repository checkout so pull requests can be checked and workflow-file changes annotated. section 3.9
Use it as part of layered workflow security:
- Check values originating from untrusted sources, including branch names, issue titles, and pull-request bodies, before they reach run commands. section 6.2
- Run automated and manual security checks before permitting jobs on contained, ephemeral self-hosted runners. section 6.2
- Treat linting as an early safeguard rather than a replacement for environment protection rules, approvals, or runner isolation. section 6.2
Linting complements debugging: test deployment scripts locally or on a virtual machine first, then use step or runner debug logging when workflow behavior still needs investigation. section 3.9
