Static Code Analysis
Check GitHub Actions workflows with actionlint
actionlint-check is a static GitHub Actions workflow checking node powered by actionlint.
overview
What actionlint-check does
Check GitHub Actions workflow definitions before running them. Connect a repository folder containing .github/workflows, or a folder of workflow YAML files. The actionlint 1.7.12 node writes a JSON array of findings with messages and file locations.
The wrapper checks only top-level .yml and .yaml files in the chosen workflow folder. An optional .github/actionlint.yaml in the repository can configure actionlint. It does not execute workflows or install their dependencies.
Actionlint checks workflow syntax, expressions and built-in action and job rules. ShellCheck and Pyflakes integrations are disabled in this image, so shell and Python code inside run steps do not receive those additional checks.
A clean result is an empty JSON array. Findings, including malformed YAML reported as syntax-check findings, are successful task output. A source folder without workflow files or a fatal tool error fails the task instead.
The saved synthetic Trickest run found an undefined matrix property and preserved its expression diagnostic and location. Local test coverage separately includes clean workflows, bare workflow folders, malformed YAML and empty folders. These checks do not establish that a workflow will succeed on a GitHub runner.
source github.com/rhysd/actionlint
use cases
Where actionlint-check fits
Inspect workflow expressions
Find undefined expression properties and inspect the reported line and column.
Review workflow YAML
Collect syntax findings from workflow files before handing them to a runner.
Pass findings to a review step
Use the JSON result as input to a separate review or policy step. Decide which findings should block later work.
reference
actionlint-check inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| source | FOLDER | --source | Repository folder containing .github/workflows, or a folder of top-level workflow YAML files. Optional .github/actionlint.yaml is respected. |
Showing key inputs. actionlint-check exposes 1 inputs in total.
example
Run actionlint-check
actionlint -no-color -shellcheck= -pyflakes= -format '{{json .}}' .github/workflows/ci.yml[
{
"message": "property \"missing\" is not defined in object type {}",
"filepath": "hive/in/fixture/broken.yml",
"line": 7,
"column": 23,
"kind": "expression",
"snippet": " - run: echo ${{ matrix.missing }}\n ^~~~~~~~~~~~~~",
"end_column": 36
}
]guidance
Choosing actionlint-check
Use this node to inspect GitHub Actions definitions without executing jobs. Add a separate shell or Python checker when you need to inspect code inside run steps.
Ruff
Checks Python source rather than GitHub Actions workflow semantics.
ShellCheck
Checks shell scripts. This actionlint node disables the ShellCheck integration.
faq
actionlint-check questions
related
More Static Code Analysis tools
bandit
Python source in, JSON security findings out.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
guarddog
A package coordinate in, indicator hits out.
malcontent-scan
A package coordinate in, behavior findings out.
osv-malicious
A package coordinate in, malware advisory rows out.
Run actionlint-check yourself
Native JSON downloaded from a completed private synthetic Trickest run. This verifies the wrapper; public consumer availability is a separate release check.
Facts on this page come from the live Trickest tool library.