v0.17.0

New: actrun lint — Static Analysis

actionlint-inspired workflow linter with 25+ rules.

actrun lint                          # Lint all workflows
actrun lint --preset oss             # Full checks including SHA pin verification
actrun lint --update-hash            # Auto-pin action refs to SHA

Expression type checking: undefined contexts, wrong function arity, unknown functions, type mismatches

Dead code detection: unreachable steps (if: false), future/undefined step refs, circular needs, unused job outputs

Structure validation: duplicate step IDs, empty jobs, invalid uses syntax, invalid glob patterns

Security checks:

• Script injection (untrusted input in run:)
• pull_request_target without permissions
• Dangerous checkout of PR head in pull_request_target
• Secrets passed to third-party actions
• Bare always() (suggest success() || failure())
• Deprecated workflow commands (::set-output, etc.)

Online checks (--online):

• Mutable action ref → suggest SHA pin with resolved hash
• Action existence verification via git ls-remote
• --update-hash: auto-rewrite files to pin SHA

Configuration:

[lint]
preset = "default"  # default, strict, oss
ignore_rules = ["unknown-property", "unused-outputs"]

New: actrun viz — Workflow Visualization

actrun viz workflow.yml              # ASCII art
actrun viz workflow.yml --mermaid    # Mermaid text
actrun viz workflow.yml --detail     # Mermaid with step subgraphs
actrun viz workflow.yml --svg        # SVG (--theme github-dark|github-light)

Example: actrun viz .github/workflows/release.yml

┌───────┐    ┌────────┐
│ build │    │ docker │
└───────┘    └────────┘
    └┐
     │
┌─────────┐
│ release │
└─────────┘

Example: actrun viz .github/workflows/release.yml --mermaid

graph TD
  build["build (6 steps)"]
  release["release (2 steps)"]
  docker["docker (6 steps)"]
  build --> release

Example: actrun viz .github/workflows/release.yml --detail

graph TD
  subgraph build ["build"]
    build_s0(["Checkout"])
    build_s1(["Checkout bit dependency"])
    build_s0 --> build_s1
    build_s2(["Install MoonBit CLI"])
    build_s1 --> build_s2
    build_s3(["Build"])
    build_s2 --> build_s3
    build_s4(["Package"])
    build_s3 --> build_s4
    build_s5(["Upload artifact"])
    build_s4 --> build_s5
  end
  subgraph release ["release"]
    release_s0(["Download artifacts"])
    release_s1(["Create release"])
    release_s0 --> release_s1
  end
  subgraph docker ["docker"]
    docker_s0(["Checkout"])
    docker_s1(["Set up QEMU"])
    docker_s0 --> docker_s1
    docker_s2(["Set up Docker Buildx"])
    docker_s1 --> docker_s2
    docker_s3(["Login to GHCR"])
    docker_s2 --> docker_s3
    docker_s4(["Extract version"])
    docker_s3 --> docker_s4
    docker_s5(["Build and push"])
    docker_s4 --> docker_s5
  end
  build --> release

CI Hardening

• All action refs SHA-pinned across all workflows
• timeout-minutes on all CI jobs
• CI slimmed to lint + test + e2e; examples moved to compat-examples.yml (workflow_dispatch)
• Example snapshot system for GHA vs local result comparison
• Cross-file action version consistency checking
• TOML parser migrated to bobzhang/toml

Security

• Canonicalize paths in validate_workspace_path to prevent directory traversal via .. segments (#8, by @hyperfinitism)
• Add symlink resolution to validate_workspace_path_real to prevent symlink-based path traversal (#10)

Features

• Support !cancelled() in runs.post-if and runs.pre-if for compatibility with actions like gradle/actions/setup-gradle (#9, by @maehata-fairy)

Refactoring

• Remove stale src/core/ package (3,630 lines of diverged dead code) (#11)