Tool Open source
jactionlint is a static checker for GitHub Actions workflow files, an actively maintained fork of rhysd/actionlint. It checks workflow syntax, types in `${{ }}` expressions, action inputs and outputs, reusable workflow interfaces, composite actions, and dependabot.yml files. It integrates ShellCheck and Pyflakes for scripts run by workflows and includes security and policy checks for script injection, unpinned actions, excessive permissions, dangerous triggers, cache poisoning, hard-coded credentials, and missing timeouts.
The tool provides correctness, default, and pedantic profiles, automatic fixes with `--fix` or `--diff`, baselines for adopting checks incrementally, durable ignores, and SARIF, GCC, and GitHub output formats. Optional online checks cover impostor commits, vulnerable actions, archived repositories, and stale references. It runs locally or in CI, and is distributed as a binary, a Go package, a Docker image, and through package managers including mise and Homebrew. jactionlint is distributed under the MIT license.
1 use taken from transcripts — each links to the moment in the video.
Checks GitHub Actions workflows before a broken or risky one reaches CI. It catches bad YAML keys, mistyped expressions, wrong action inputs, script injection, overly broad permissions and unpinned actions, with suggested fixes and baseline support.
1 in the library.