v1.6.26

• Several template fields and template actions were added. All fields and actions are listed in the document. Please read it for more details. (#311)
  • By these additions, now actionlint can output the result in the SARIF format. SARIF is a format for the output of static analysis tools used by GitHub CodeQL. the example Go template to format actionlint output in SARIF.

    actionlint -format "$(cat /path/to/sarif_template.txt)" > output.json

  • allKinds returns the kinds (lint rules) information as an array. You can include what lint rules are defined in the command output.
  • toPascalCase converts snake case (foo_bar) or kebab case (foo-bar) into pascal case (FooBar).
• Report an error when the condition at if: is always evaluated to true. See the check document to know more details. (#272)

  # ERROR: All the following `if:` conditions are always evaluated to true
  - run: echo 'Commit is pushed'
    if: |
      ${{ github.event_name == 'push' }}
  - run: echo 'Commit is pushed'
    if: "${{ github.event_name == 'push' }} "
  - run: echo 'Commit is pushed to main'
    if: ${{ github.event_name == 'push' }} && ${{ github.ref_name == 'main' }}

• Fix actionlint didn't understand ${{ }} placeholders in environment variable names. (#312)

  env:
    "${{ steps.x.outputs.value }}": "..."

• Fix type of matrix row when some expression is assigned to it with ${{ }} (#285)

  strategy:
    matrix:
      test:
        # Matrix rows are assigned from JSON string
        - ${{ fromJson(inputs.matrix) }}
  steps:
    - run: echo ${{ matrix.test.foo.bar }}

• Fix checking exclude of matrix was incorrect when some matrix row is dynamically constructed with ${{ }}. (#261)

  strategy:
    matrix:
      build-type:
        - debug
        - ${{ fromJson(inputs.custom-build-type) }}
      exclude:
        # 'release' is not listed in 'build-type' row, but it should not be reported as error
        # since the second row of 'build-type' is dynamically constructed with ${{ }}.
        - build-type: release

• Fix checking exclude of matrix was incorrect when object is nested at row of the matrix. (#249)

  matrix:
    os:
      - name: Ubuntu
        matrix: ubuntu
      - name: Windows
        matrix: windows
    arch:
      - name: ARM
        matrix: arm
      - name: Intel
        matrix: intel
    exclude:
      # This should exclude { os: { name: Windows, matrix: windows }, arch: {name: ARM, matrix: arm } }
      - os:
          matrix: windows
        arch:
          matrix: arm

• Fix data race when actionlint.yml config file is used by multiple goroutines to check multiple workflow files. (#333)
• Check keys' case sensitivity. (#302)

  steps:
    # ERROR: 'run:' is correct
    - ruN: echo "hello"

• Add number as input type of workflow_dispatch event. (#316)
• Check max number of inputs of workflow_dispatch event is 10.
• Check numbers at timeout-minutes and max-parallel are greater than zero.
• Add Go APIs to define a custom rule. Please read the code example to know the usage.
  • Make some RuleBase methods public which are useful to implement your own custom rule type. (thanks @hugo-syn, #327, #331)
  • OnRulesCreated field is added to LinterOptions struct. You can modify applied rules with the hook (add your own rule, remove some rule, ...).
• Add NewProject() Go API to create a Project instance.
• Fix tests failed when sources are downloaded from .tar.gz link. (#307)
• Improve the pre-commit document to explain all pre-commit hooks by this repository.
• Clarify the regular expression syntax of -ignore option is RE2. (#320)
• Use ubuntu-latest runner to create winget release. (thanks @sitiom, #308)
• Update popular actions data set, available contexts, webhook types to the latest.
  • Fix typo in watch webhook's types (thanks @suzuki-shunsuke, #334)
  • Add secret_source property to github context. (thanks @asml-mdroogle, #339)
  • Many new major releases are added to the popular actions data set (including actions/checkout@v4).
• Use Go 1.21 to build release binaries.
• Update Go dependencies to the latest. (thanks @harryzcy, #322)