v2.3.0: allow-unused for config ignores, and a Go toolchain fix for online checks

jactionlint 2.3.0 adds an allow-unused option to ignores entries in the config file and fixes a workflow-call-permissions false positive for OIDC. It is also built with Go 1.27.3, so online checks reject certificates from the compromised eMudhra CA.

Added

• allow-unused for durable ignores. An ignores entry with allow-unused: true is not reported as unused-ignore when it suppresses nothing. Use it for findings that come and go, such as one caused by a moving tag. expired-ignore still reports the entry when it expires. The default is false, and any value other than true or false is a config error. The option is also in the config JSON Schema. (#297, @jdx)

  ignores:
    - rule: unpinned-uses
      uses: actions/cache
      reason: pinned by the Actions lock file on some branches
      allow-unused: true

Fixed

• workflow-call-permissions no longer reports a missing id-token: write when the caller sets no permissions: and assume-default-permissions is permissive or not set. In that case, GitHub gives the called job an OIDC token. With assume-default-permissions: restricted, jactionlint still reports it. (#299, @jdx)
• Online checks reject forged certificates from the compromised eMudhra CA. Release binaries are now built with Go 1.27.3, which rejects these certificate chains. Older binaries do not have this fix, so replace them with this release if you use --online. (#301, @jdalton)

New Contributors

• @jdalton made their first contribution in #292

Full Changelog: v2.2.0...v2.3.0

💚 Sponsor jactionlint

jactionlint is a fork of rhysd/actionlint, maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If jactionlint has a place in your development workflow, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep jactionlint fast, free, and independent.