v1.11.0

What's changed

• Replace the Python action entrypoint with a Go program that reuses the actionlint package directly, keeping every declared input, output, format, and failure mode, and confining all workspace file access to an os.Root handle. (#16)
• Replace scripts/bump-version.bash with a Go tool that declares every version-bearing file and its expected occurrence count, verifies each update, refuses to run on a dirty tree or an existing tag, and pushes only with an explicit flag. (#17)
• Raise the minimum Go version to 1.26 with Go 1.27 as the CI default, replace the 6x2 test matrix with seven targeted jobs plus one race and coverage job, cancel superseded pull request runs, and pin every action and Docker base image to a commit SHA. (#14)
• Consolidate the JavaScript tooling into a single root npm workspace with one lockfile. (#15)
• Add a first-party Docker action with validated inputs, GitHub annotations, multiple output formats, and structured result outputs, following up on rhysd#257 and rhysd#479. Release images are published as action-{version}, action-v1, and action-latest, so consumer workflows pull a prebuilt actionlint, ShellCheck, and pyflakes image instead of compiling actionlint. Releases also update the moving v1 Git tag for kjanat/actionlint@v1. (#5)
• Harden the Docker action and its release path by containing configuration and workflow inputs within the workspace, rejecting option-like paths and directory output destinations before linting, bounding actionlint execution time, pinning the Alpine runtime, defaulting the CLI image to /w, serializing releases before moving mutable image aliases, and verifying every expected version replacement independently.
• Restore the generated command manual to the fork's Pages deployment at usage.html and man.html, add a 404.html fallback, and document whether each third-party integration uses this fork, upstream actionlint, or a configurable local executable.
• Report ShellCheck findings at their exact YAML source locations for literal block and plain run: scripts, including precise ranges. Scalar forms that cannot be mapped safely continue to report at the run: key. (rhysd#88, rhysd#360; building on the direction explored in rhysd#556, thanks @dpsutton)
• Update the playground's preloaded workflow to the current major versions of actions/checkout, actions/setup-node, and actions/cache.

v1.10.0

What's changed

• Move the Go module to github.com/kjanat/actionlint and update installation and API documentation for the fork.
• Update the README workflow example to the current major versions of actions/checkout, actions/setup-node, and actions/cache.
• Make download-script CI release-safe by resolving latest dynamically on branch pushes, testing the pinned default only after release assets are uploaded, and failing cleanly for missing assets.

Full Changelog: v1.9.0...v1.10.0

v1.9.0

What's changed

• Support background, wait, wait-all, cancel, and parallel steps, including validation of background-step references and invalid nested parallel steps. (rhysd#695, thanks @devantler)
• Support the code-quality and vulnerability-alerts permission scopes with their GitHub-supported access levels, and accept the models and repository-projects permission names. (rhysd#674, thanks @smlx; rhysd#714, thanks @kalverra)
• Support $/path self-repository references for actions and reusable workflows, including local metadata, input, and output validation. (rhysd#711)
• Support job.workflow_file_path, job.workflow_ref, job.workflow_repository, job.workflow_sha, and jobs.<job_id>.result in expressions. (rhysd#696, thanks @nikolauspschuetz; rhysd#707, thanks @l46983284-cpu; rhysd#724, thanks @Eljees)
• Avoid false errors for repository secrets in reusable workflows that also define another trigger. (rhysd#701, rhysd#703, thanks @Eljees)
• Support the destroyed activity type for the merge_group event and refresh the generated webhook activity types. (rhysd#726)
• Update the popular actions data set with current major releases, including actions/checkout@v7, actions/cache@v6, actions/setup-go@v7, and codecov/codecov-action@v7. (Based on rhysd#718, thanks @kolyshkin)

Full Changelog: v1.8.0...v1.9.0

v1.8.0

What's changed

• Add support for entrypoint and command in service containers. (rhysd#645, thanks @mkusaka)
• Fix a macOS ShellCheck integration deadlock when linting large scripts concurrently. (rhysd#651, thanks @attehuhtakangas)
• Support the queue configuration in workflow- and job-level concurrency. The documented literal values single (default) and max are accepted, and invalid values or queue: max combined with cancel-in-progress: true are reported as errors. (rhysd#654, rhysd#657, thanks @vvoland)
• Support the ubuntu-26.04, ubuntu-26.04-arm, xcode-27, xcode-27-xlarge, and windows-11-vs2026-arm runner labels. (rhysd#683, thanks @ericcornelissen; rhysd#710, thanks @TheAlphaEngineerCode)
• Follow the moving runner aliases: macos-latest now maps to macos-26, macos-latest-large maps to macos-26-large, and windows-latest and windows-2025 map to windows-2025-vs2026. The macOS and Windows migrations are confirmed in actions/runner-images#14167 and actions/runner-images#14017.
• Update Go dependencies to the latest versions, including go-yaml v4.0.0-rc.6. YAML parse errors now report corrected columns and source positions for undefined aliases.
• Keep CI compatible with current Windows arm64 runner and hadolint images by installing ShellCheck with Chocolatey and using Alpine's numeric guest UID in the container image.
• Enable releases from kjanat/actionlint, publish multi-platform Docker images to ghcr.io/kjanat/actionlint with GITHUB_TOKEN, and skip Winget and Homebrew publishing.

Full Changelog: v1.7.12...v1.8.0