Release v0.1.3 · preloopdev/loopt

loopt lint now catches the mistakes that previously only surfaced after a push, and can verify your pinned actions against GitHub.

Correctness checks

Triggers (#1)

preloop/unknown-event, preloop/unknown-activity-type: misspelled events and types: values (pull_request: types: [opend])
preloop/invalid-event-filter: filters on events that ignore them; branches with branches-ignore on the same event
preloop/invalid-glob: malformed branch, tag and path filters
preloop/invalid-cron, preloop/cron-too-frequent: schedules GitHub rejects or throttles
preloop/invalid-dispatch-input: bad workflow_dispatch / workflow_call inputs, outputs and secrets

Expression references (#2)

preloop/undefined-step-reference, preloop/undefined-needs-reference, preloop/undefined-matrix-key, preloop/undefined-input: typo'd steps.*, needs.*.outputs.*, matrix.* and inputs.*
preloop/unavailable-context: contexts used where GitHub doesn't provide them (for example secrets in a job if:)
preloop/unknown-context-property: unknown github.*, runner.*, job.* and strategy.* properties

Jobs and steps (#3)

preloop/unknown-key: keys GitHub ignores, with a "did you mean" hint (runs_on → runs-on)
preloop/unknown-runner-label: runs-on labels that match no GitHub-hosted runner (unless you pass a runner inventory with --context)
preloop/floating-runner-image (info): *-latest images that move between OS versions
preloop/invalid-shell, preloop/invalid-permission, preloop/invalid-id, preloop/invalid-env-name
preloop/deprecated-command: ::set-output, ::save-state, ::set-env, ::add-path
preloop/constant-condition: if: conditions that are always true or always false

dangerous-checkout: actions/checkout with allow-unsafe-pr-checkout enabled (#5)
loopt lint --online checks every uses: against GitHub through gh: impostor-commit, ref-confusion, known-vulnerable-actions, archived-uses, ref-version-mismatch and stale-action-refs. Without --online, these report as unavailable, as before. (#5)