actionlint

Visit Website

Introduction

actionlint is a static checker for GitHub Actions workflow files. It parses workflows and reports problems that GitHub would only reveal at run time, or never.

Checks include YAML syntax, unknown keys, ${{ }} expression syntax and type checking, references to undefined job outputs or matrix values, invalid cron schedules, action input validation for popular actions, runner label typos, and potential script injection from untrusted inputs. When ShellCheck and pyflakes are installed, it also lints run: scripts.

In the quality loop it is a pre-merge check for the pipeline definition itself.

The source code is at rhysd/actionlint on GitHub under the MIT licence, with about 4,400 stars; the most recent commit was on 19 April 2026.

Features

1. Expression type checks: Catches wrong types and undefined properties.
2. Action input checks: Validates inputs to popular actions.
3. ShellCheck integration: Lints run scripts.
4. Injection warnings: Flags untrusted input used in scripts.
5. Fast single binary: Written in Go.
6. Playground: Try it in the browser.

Pros

1. High signal: Findings are usually real bugs.
2. Free to use: Open source under the MIT licence, so the core tool costs nothing to use.
3. Actively maintained: The repository had commits as recent as 19 April 2026.
4. Community: About 4,400 GitHub stars.

Cons

1. GitHub only: Not for other CI systems.
2. External tools: Shell linting needs ShellCheck installed.
3. Security depth: Use zizmor for deeper security auditing.

Usage and Links (Example)

actionlint
# or in CI
docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:latest -color

Resources:

• actionlint website
• GitHub repository

Pricing

actionlint is free and open source under the MIT licence.

Recommended for?

1. Any repository using GitHub Actions.
2. Platform teams maintaining shared workflows.

Conclusion

actionlint is a quick win for any team on GitHub Actions.

Run it on every change to .github/workflows/.

On CheckOps, actionlint is filed under the Release & CI gates stage. Related tools listed here include act, zizmor, OpenSSF Scorecard, pre-commit, Super-Linter and Gitleaks. A short trial on a real project, with your own code, data and pipeline, is usually the fastest way to choose between them, because fit matters more than feature lists. Facts here come from the official site, documentation and repository, checked on 11 November 2026.