How to scan workflows for security issues with actionlint
actionlint, static analysis for workflows, common workflow errors, expression syntax checking, shellcheck integration, CI integration for actionlint, fixing lint errors
What is actionlint?
actionlint is a static analysis tool that checks GitHub Actions workflow files for errors and security issues before they reach production. It catches problems that the GitHub runtime only reveals at execution time.
What actionlint Detects
Expression syntax errors (${{ }} typos), shellcheck violations in run steps, missing required inputs, undefined step IDs, invalid event names, and potential script injection patterns.
Running actionlint in CI
name: Lint Workflows
on:
push:
paths:
- '.github/workflows/**'
jobs:
actionlint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run actionlint
uses: rhysd/actionlint@v1
with:
ignore: 'SC2086' # optional: ignore specific shellcheck rulesTrigger this workflow only when workflow files change using paths filtering. The rhysd/actionlint action installs the binary and shellcheck automatically. Run actionlint locally during development: brew install actionlint on macOS or download the binary from the GitHub releases page.