v0.1.4

Reusable workflows are now checked and locked.

Reusable workflow calls are checked against their workflow (#6)

loopt lint compares every jobs.<id>.uses: call with the called workflow's on.workflow_call declaration:

• preloop/reusable-unknown-input, preloop/reusable-missing-input, preloop/reusable-input-type: undeclared inputs, missing required inputs, and literal values of the wrong type
• preloop/reusable-unknown-secret, preloop/reusable-missing-secret: secrets that don't match the declaration (skipped for secrets: inherit)
• preloop/reusable-unknown-output: needs.<call>.outputs.<name> that the called workflow doesn't declare
• preloop/reusable-not-callable, preloop/reusable-callee-missing: local workflows without a workflow_call trigger, or missing files

Local workflows (./ and $/) are read from the repo. Remote workflows are fetched at their ref with loopt lint --online; without it, they're skipped.

loopt lock pins reusable workflows (#7)

• Reusable calls are pinned to a full commit SHA with owner_id/repo_id. The actions inside each called workflow, and any reusable workflows it calls, are pinned too.
• The pins live in .github/workflows/reusable.lock. GitHub's actions.lock format can't record reusable workflows, so this keeps actions.lock valid for gh actions-lock and the hosted runner.
• loopt lock --verify detects moved refs. --verify-local requires an entry for every remote call; run loopt lock once after upgrading.
• Also reads v0.0.3 actions.lock files written by current gh actions-lock.

v0.1.3

loopt lint now catches the mistakes that previously only surfaced after a push, and can verify your pinned actions against GitHub.

Correctness checks

Triggers (#1)

• preloop/unknown-event, preloop/unknown-activity-type: misspelled events and types: values (pull_request: types: [opend])
• preloop/invalid-event-filter: filters on events that ignore them; branches with branches-ignore on the same event
• preloop/invalid-glob: malformed branch, tag and path filters
• preloop/invalid-cron, preloop/cron-too-frequent: schedules GitHub rejects or throttles
• preloop/invalid-dispatch-input: bad workflow_dispatch / workflow_call inputs, outputs and secrets

Expression references (#2)

• preloop/undefined-step-reference, preloop/undefined-needs-reference, preloop/undefined-matrix-key, preloop/undefined-input: typo'd steps.*, needs.*.outputs.*, matrix.* and inputs.*
• preloop/unavailable-context: contexts used where GitHub doesn't provide them (for example secrets in a job if:)
• preloop/unknown-context-property: unknown github.*, runner.*, job.* and strategy.* properties

Jobs and steps (#3)

• preloop/unknown-key: keys GitHub ignores, with a "did you mean" hint (runs_on → runs-on)
• preloop/unknown-runner-label: runs-on labels that match no GitHub-hosted runner (unless you pass a runner inventory with --context)
• preloop/floating-runner-image (info): *-latest images that move between OS versions
• preloop/invalid-shell, preloop/invalid-permission, preloop/invalid-id, preloop/invalid-env-name
• preloop/deprecated-command: ::set-output, ::save-state, ::set-env, ::add-path
• preloop/constant-condition: if: conditions that are always true or always false

Security

• dangerous-checkout: actions/checkout with allow-unsafe-pr-checkout enabled (#5)
• loopt lint --online checks every uses: against GitHub through gh: impostor-commit, ref-confusion, known-vulnerable-actions, archived-uses, ref-version-mismatch and stale-action-refs. Without --online, these report as unavailable, as before. (#5)

CI

• CI now runs the vendored crates' unit tests (#4).

v0.1.2

Full Changelog: v0.1.1...v0.1.2

v0.1.1

Full Changelog: v0.1.0...v0.1.1

v0.1.0

Full Changelog: https://github.com/preloopdev/loopt/commits/v0.1.0