@@ -45,7 +45,7 @@ List of checks:
45
45
Note that actionlint focuses on catching mistakes in workflow files. If you want some general code style checks, please consider
46
46
using a general YAML checker like [ yamllint] [ ] .
47
47
48
- <a name =" check-unexpected-keys " ></a >
48
+ <a id =" check-unexpected-keys " ></a >
49
49
## Unexpected keys
50
50
51
51
Example input:
@@ -88,7 +88,7 @@ actionlint can detect unexpected keys while parsing workflow syntax and report t
88
88
Key names are basically case-sensitive (though some specific key names are case-insensitive). This check is useful to catch
89
89
case-sensitivity mistakes.
90
90
91
- <a name ="check-missing-required-duplicate-keys"></a>
91
+ <a id ="check-missing-required-duplicate-keys"></a>
92
92
## Missing required keys and key duplicates
93
93
94
94
Example input:
@@ -129,7 +129,7 @@ And duplicate keys are not allowed. In workflow syntax, comparing some keys is *
129
129
130
130
actionlint checks these missing required keys and duplicate keys while parsing, and reports an error.
131
131
132
- <a name ="check-empty-mapping"></a>
132
+ <a id ="check-empty-mapping"></a>
133
133
# # Unexpected empty mappings
134
134
135
135
Example input :
@@ -155,7 +155,7 @@ Some mappings and sequences should not be empty. For example, `steps:` must incl
155
155
actionlint checks such mappings and sequences are not empty while parsing, and reports the empty mappings and sequences as an
156
156
error.
157
157
158
- <a name ="check-mapping-values"></a>
158
+ <a id ="check-mapping-values"></a>
159
159
# # Unexpected mapping values
160
160
161
161
Example input :
@@ -201,7 +201,7 @@ Some mapping values are restricted to some constant strings. Several mapping val
201
201
actionlint checks such constant strings are used properly while parsing and reports an error when an unexpected value is
202
202
specified.
203
203
204
- <a name ="check-syntax-expression"></a>
204
+ <a id ="check-syntax-expression"></a>
205
205
# # Syntax check for expression `${{ }}`
206
206
207
207
Example input :
@@ -248,7 +248,7 @@ test.yaml:13:38: unexpected end of input while parsing object property dereferen
248
248
actionlint lexes and parses expression in `${{ }}` following [the expression syntax document][expr-doc]. It can detect
249
249
many syntax errors like invalid characters, missing parentheses, unexpected end of input, ...
250
250
251
- <a name ="check-type-check-expression"></a>
251
+ <a id ="check-type-check-expression"></a>
252
252
# # Type checks for expression syntax in `${{ }}`
253
253
254
254
actionlint checks types of expressions in `${{ }}` placeholders of templates. The following types are supported by the type
@@ -371,7 +371,7 @@ test.yaml:19:14: type of expression at "env" must be object but found type strin
371
371
372
372
In above example, environment variables mapping is expanded at ` env: ` section. actionlint checks type of the expanded value.
373
373
374
- <a name =" check-contexts-and-builtin-func " ></a >
374
+ <a id =" check-contexts-and-builtin-func " ></a >
375
375
## Contexts and built-in functions
376
376
377
377
Example input:
@@ -445,7 +445,7 @@ string.
445
445
446
446
Note that context names and function names are case-insensitive. For example, `toJSON` and `toJson` are the same function.
447
447
448
- <a name ="check-contextual-step-object"></a>
448
+ <a id ="check-contextual-step-object"></a>
449
449
# # Contextual typing for `steps.<step_id>` objects
450
450
451
451
Example input :
@@ -599,7 +599,7 @@ test.yaml:15:23: property "some-value" is not defined in object type {some_value
599
599
The 'My action with output' action defines one output `some_value`. The property is typed at `steps.my_action.outputs` object
600
600
so that actionlint can check incorrect property accesses like a typo in the output name.
601
601
602
- <a name ="check-contextual-matrix-object"></a>
602
+ <a id ="check-contextual-matrix-object"></a>
603
603
## Contextual typing for `matrix` object
604
604
605
605
Example input:
@@ -687,7 +687,7 @@ steps:
687
687
- run : echo ${{ matrix.bar }}
688
688
` ` `
689
689
690
- <a name ="check-contextual-needs-object"></a>
690
+ <a id ="check-contextual-needs-object"></a>
691
691
## Contextual typing for ` needs` object
692
692
693
693
Example input :
@@ -756,7 +756,7 @@ Outputs from the jobs can be accessed only from jobs following them via [`needs`
756
756
757
757
actionlint defines a type of `needs` variable contextually by looking at each job's `outputs:` section and `needs:` section.
758
758
759
- <a name ="check-comparison-types"></a>
759
+ <a id ="check-comparison-types"></a>
760
760
# # Strict type checks for comparison operators
761
761
762
762
Example input :
@@ -812,7 +812,7 @@ There are some additional surprising behaviors, but actionlint allows them not t
812
812
- ` '0' == false` and `0 == false` are true due to the same reason as above
813
813
- Objects and arrays are only considered equal when they are the same instance
814
814
815
- <a name ="check-shellcheck-integ"></a>
815
+ <a id ="check-shellcheck-integ"></a>
816
816
# # [shellcheck][] integration for `run:`
817
817
818
818
Example input :
@@ -918,7 +918,7 @@ On GitHub Actions:
918
918
SHELLCHECK_OPTS: --exclude=SC2129
919
919
` ` `
920
920
921
- <a name ="check-pyflakes-integ"></a>
921
+ <a id ="check-pyflakes-integ"></a>
922
922
# # [pyflakes][] integration for `run:`
923
923
924
924
Example input :
@@ -987,7 +987,7 @@ Since both `${{ }}` expression syntax is invalid as Python, remaining `${{ }}` m
987
987
actionlint replaces `${{ }}` with underscores. For example `print('${{ matrix.os }}')` is replaced with
988
988
` print('________________')` .
989
989
990
- <a name ="untrusted-inputs"></a>
990
+ <a id ="untrusted-inputs"></a>
991
991
# # Script injection by potentially untrusted inputs
992
992
993
993
Example input :
@@ -1096,7 +1096,7 @@ Instead, you should store the JSON string in an environment variable:
1096
1096
At last, the popular action [actions/github-script][github-script] has the same issue in its `script` input. actionlint also
1097
1097
checks the input.
1098
1098
1099
- <a name ="check-job-deps"></a>
1099
+ <a id ="check-job-deps"></a>
1100
1100
# # Job dependencies validation
1101
1101
1102
1102
Example input :
@@ -1169,7 +1169,7 @@ test.yaml:8:3: job "bar" needs job "unknown" which does not exist in this workfl
1169
1169
1170
1170
[Playground](https://rhysd.github.io/actionlint/#eNqkjDsOAjEMRPucYrptyAXcwRFoEUUMRuEjexXb4vooS0VNNdLMvGdKWNN7eRg7FeBmNgNQkasTTtzGDof98by1I9XrhJJTI+urhXhsk4es/mWBOp8EuXTD0u9LAbiNX3PqU+2t/4k/AQAA//96DTh7)
1171
1171
1172
- <a name ="check-matrix-values"></a>
1172
+ <a id ="check-matrix-values"></a>
1173
1173
# # Matrix values
1174
1174
1175
1175
Example input :
@@ -1217,7 +1217,7 @@ combination of matrix values. actionlint checks
1217
1217
- values in `exclude:` appear in `matrix:` or `include:`
1218
1218
- duplicate variations of matrix values
1219
1219
1220
- <a name ="check-webhook-events"></a>
1220
+ <a id ="check-webhook-events"></a>
1221
1221
# # Webhook events validation
1222
1222
1223
1223
Example input :
@@ -1299,7 +1299,7 @@ actionlint validates the Webhook configurations:
1299
1299
The table of available Webhooks and their types are defined in [`all_webhooks.go`](../all_webhooks.go). It is generated
1300
1300
by [a script][generate-webhook-events] and kept to the latest by CI workflow triggered weekly.
1301
1301
1302
- <a name ="check-workflow-dispatch-events"></a>
1302
+ <a id ="check-workflow-dispatch-events"></a>
1303
1303
# # Workflow dispatch event validation
1304
1304
1305
1305
Example input :
@@ -1447,7 +1447,7 @@ inputs:
1447
1447
}
1448
1448
` ` `
1449
1449
1450
- <a name ="check-glob-pattern"></a>
1450
+ <a id ="check-glob-pattern"></a>
1451
1451
# # Glob filter pattern syntax validation
1452
1452
1453
1453
Example input :
@@ -1504,7 +1504,7 @@ workflow. It checks:
1504
1504
Most common mistake I have ever seen here is a misunderstanding that regular expression is available for filtering.
1505
1505
This rule can catch the mistake so that users can notice their mistakes.
1506
1506
1507
- <a name =" check-cron-syntax " ></a >
1507
+ <a id =" check-cron-syntax " ></a >
1508
1508
## CRON syntax check at ` schedule: `
1509
1509
1510
1510
Example input:
@@ -1547,7 +1547,7 @@ actionlint checks the CRON syntax and frequency of running a job. [The official
1547
1547
1548
1548
When the job is run more frequently than once every 5 minutes, actionlint reports it as an error.
1549
1549
1550
- <a name ="check-runner-labels"></a>
1550
+ <a id ="check-runner-labels"></a>
1551
1551
## Runner labels
1552
1552
1553
1553
Example input:
@@ -1638,7 +1638,7 @@ test.yaml:4:30: label "windows-latest" conflicts with label "ubuntu-latest" defi
1638
1638
In most cases, this is a misunderstanding that a matrix combination can be specified at `runs-on:` directly. It should use
1639
1639
` matrix:` and expand it with `${{ }}` at `runs-on:` to run the workflow on multiple runners.
1640
1640
1641
- <a name ="check-action-format"></a>
1641
+ <a id ="check-action-format"></a>
1642
1642
# # Action format in `uses:`
1643
1643
1644
1644
Example input :
@@ -1694,7 +1694,7 @@ Note that actionlint does not report any error when a directory for a local acti
1694
1694
a common case where the action is managed in a separate repository and the action directory is cloned at running the workflow.
1695
1695
(See [#25][issue-25] and [#40][issue-40] for more details).
1696
1696
1697
- <a name ="check-local-action-inputs"></a>
1697
+ <a id ="check-local-action-inputs"></a>
1698
1698
# # Local action inputs validation at `with:`
1699
1699
1700
1700
My action definition at `.github/actions/my-action/action.yaml` :
@@ -1757,7 +1757,7 @@ test.yaml:13:11: input "additions" is not defined in action "My action" defined
1757
1757
When a local action is run in `uses:` of `step:`, actionlint reads `action.yml` file in the local action directory and
1758
1758
validates inputs at `with:` in the workflow are correct. Missing required inputs and unexpected inputs can be detected.
1759
1759
1760
- <a name ="check-popular-action-inputs"></a>
1760
+ <a id ="check-popular-action-inputs"></a>
1761
1761
## Popular action inputs validation at `with:`
1762
1762
1763
1763
Example input:
@@ -1808,7 +1808,7 @@ So far, actionlint supports more than 100 popular actions The data set is embedd
1808
1808
and were automatically collected by [ a script] [ generate-popular-actions ] . If you want more checks for other actions, please
1809
1809
make a request [ as an issue] [ issue-form ] .
1810
1810
1811
- <a name =" detect-outdated-popular-actions " ></a >
1811
+ <a id =" detect-outdated-popular-actions " ></a >
1812
1812
## Outdated popular actions detection at ` uses: `
1813
1813
1814
1814
Example input:
@@ -1843,7 +1843,7 @@ Note that this check doesn't report that the action version is up-to-date. For e
1843
1843
newer version `actions/checkout@v5` is available, actionlint reports no error as long as `actions/checkout@v4` is not outdated.
1844
1844
If you want to keep actions used by your workflows up-to-date, consider to use [Dependabot][dependabot-doc].
1845
1845
1846
- <a name ="check-shell-names"></a>
1846
+ <a id ="check-shell-names"></a>
1847
1847
# # Shell name validation at `shell:`
1848
1848
1849
1849
Example input :
@@ -1907,7 +1907,7 @@ test.yaml:27:16: shell name "sh" is invalid on Windows. available names are "bas
1907
1907
Available shells for runners are defined in [the documentation][shell-doc]. actionlint checks shell names at `shell:`
1908
1908
configuration are properly using the available shells.
1909
1909
1910
- <a name ="check-job-step-ids"></a>
1910
+ <a id ="check-job-step-ids"></a>
1911
1911
# # Job ID and step ID uniqueness
1912
1912
1913
1913
Example input :
@@ -1950,7 +1950,7 @@ test.yaml:12:3: key "TEST" is duplicated in "jobs" section. previously defined a
1950
1950
Job IDs and step IDs in each jobs must be unique. IDs are compared in case-insensitive. actionlint checks all job IDs
1951
1951
and step IDs, and reports errors when some IDs duplicate.
1952
1952
1953
- <a name ="check-hardcoded-credentials"></a>
1953
+ <a id ="check-hardcoded-credentials"></a>
1954
1954
# # Hardcoded credentials
1955
1955
1956
1956
Example input :
@@ -1996,7 +1996,7 @@ test.yaml:17:21: "password" section in "redis" service should be specified via s
1996
1996
and the value should be expanded with `${{ }}` syntax at `password:`. actionlint checks hardcoded credentials, and reports
1997
1997
them as an error.
1998
1998
1999
- <a name ="check-env-var-names"></a>
1999
+ <a id ="check-env-var-names"></a>
2000
2000
# # Environment variable names
2001
2001
2002
2002
Example input :
@@ -2033,7 +2033,7 @@ cases they are mistakes, and they may cause some issues on using them in shell s
2033
2033
2034
2034
actionlint checks environment variable names are correct in `env:` configuration.
2035
2035
2036
- <a name ="permissions"></a>
2036
+ <a id ="permissions"></a>
2037
2037
# # Permissions
2038
2038
2039
2039
Example input :
@@ -2080,7 +2080,7 @@ Each permission scopes have its access levels. The default levels are described
2080
2080
2081
2081
actionlint checks permission scopes and access levels in a workflow are correct.
2082
2082
2083
- <a name ="check-reusable-workflows"></a>
2083
+ <a id ="check-reusable-workflows"></a>
2084
2084
# # Reusable workflows
2085
2085
2086
2086
[Reusable workflows][reusable-workflow-doc] is a feature to call a workflow from another workflow.
@@ -2513,7 +2513,7 @@ as `{version: string}`. In the downstream job, actionlint can report an error at
2513
2513
2514
2514
Note that this check only works with local reusable workflow (starting with `./`).
2515
2515
2516
- <a name ="id-naming-convention"></a>
2516
+ <a id ="id-naming-convention"></a>
2517
2517
# # ID naming convention
2518
2518
2519
2519
Example input :
@@ -2567,7 +2567,7 @@ test.yaml:17:3: invalid job ID "2d-game". job ID must start with a letter or _ a
2567
2567
IDs must start with a letter or `_` and contain only alphanumeric characters, `-` or `_`. actionlint checks the naming
2568
2568
convention, and reports invalid IDs as errors.
2569
2569
2570
- <a name ="ctx-spfunc-availability"></a>
2570
+ <a id ="ctx-spfunc-availability"></a>
2571
2571
# # Contexts and special functions availability
2572
2572
2573
2573
Example input :
@@ -2639,7 +2639,7 @@ keys.
2639
2639
actionlint checks if these contexts and special functions are used correctly. It reports an error when it finds that some context
2640
2640
or special function is not available in your workflow.
2641
2641
2642
- <a name ="#check-deprecated-workflow-commands"></a>
2642
+ <a id ="#check-deprecated-workflow-commands"></a>
2643
2643
# # Check deprecated workflow commands
2644
2644
2645
2645
Example input :
@@ -2680,7 +2680,7 @@ GitHub deprecated the following workflow commands.
2680
2680
actionlint detects these commands are used in `run:` and reports them as errors suggesting alternatives. See
2681
2681
[the official document][workflow-commands-doc] for the comprehensive list of workflow commands to know the usage.
2682
2682
2683
- <a name ="if-cond-always-true"></a>
2683
+ <a id ="if-cond-always-true"></a>
2684
2684
# # Conditions always evaluated to true at `if:`
2685
2685
2686
2686
Example input :
@@ -2763,7 +2763,7 @@ works as intended.
2763
2763
actionlint checks all `if:` conditions in workflow and reports error when some condition is always evaluated to true due to extra
2764
2764
characters around `${{ }}`.
2765
2765
2766
- <a name ="action-metadata-syntax"></a>
2766
+ <a id ="action-metadata-syntax"></a>
2767
2767
# # Action metadata syntax validation
2768
2768
2769
2769
Example action metadata :
0 commit comments