lint_workflows
Audits GitHub Actions workflows and composite actions against 33 rules, reporting rule IDs, severity, exact file:line locations, explanations, and concrete fixes without modifying files.
Instructions
Lint workflows and composite actions with 33 rules (GHA1001-GHA1033). Each finding has a rule id,
severity (error/warning/info), file:line (exact line inside multi-line run: | blocks), an
explanation and a concrete fix. Covers: actions not pinned to a commit SHA, pwn requests
(pull_request_target / workflow_run + checkout of PR code), script injection through
github.event.* / head_ref / inputs inside run: or github-script, missing or write-all permissions,
secrets: inherit, secrets echoed or on command lines, curl | bash, checkout credentials left behind,
self-hosted runners on PR triggers, deprecated commands (set-output, set-env), timeouts, concurrency,
needs mistakes and cycles, always-true if: expressions, unknown/misspelled contexts, matrix size,
reusable-workflow input/secret mismatches, retired action versions (dated table), cache keys,
continue-on-error, unquoted 3.10 versions, invalid cron. Suppress with
# workflowlint-ignore: GHA1003 above the line. Never modifies anything.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | . |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |