jdx / jactionlint

# jactionlint
**Catch broken and insecure GitHub Actions workflows before they run.**
Documentation · Playground · Rules · Changelog
jactionlint is a static checker for GitHub Actions. It reads your workflows, composite actions and `dependabot.yml` and reports two kinds of problems: the mistakes that make a run fail or misbehave, and the patterns that let an outsider run code in your repository or steal its token. It started as a fork of actionlint and covers its checks, and its security rules follow the audits of zizmor.
- **Correctness.** Unknown keys and events, type errors in `${{ }}` expressions, wrong inputs of actions and reusable workflows, and broken `needs:`, cron and glob patterns. shellcheck and pyflakes check the scripts of `run:` steps.
- **Security.** Script injection, excessive token permissions, dangerous triggers such as `pull_request_target`, cache poisoning, credentials left in the checkout and AI agent actions that outsiders can steer.
- **Policy.** Actions used by a tag instead of a commit, and workflows without `permissions:`, a job timeout or a concurrency group.
- **Fixes.** `jactionlint --fix` repairs what has a mechanical fix, and `--diff` shows the change first.
- **Gradual adoption.** Profiles choose how much is checked, and a baseline fails the build only on new findings.
- **No network unless you ask.** The online checks, which ask GitHub about archived repositories, impostor commits and published advisories, run only with `--online`.
Try it without installing anything in the playground, which runs jactionlint in your browser.
## Quick start
Install jactionlint with mise and run it at the root of a repository:
 [code] 
With no arguments, jactionlint checks the workflows, composite actions, `dependabot.yml` and Actions lock file of the repository. Pass file names to check only those, or `-` to read standard input. It exits with status 1 when a finding of level `error` is left.
Other ways to install it:
- **Homebrew:** `brew tap jdx/jactionlint https://github.com/jdx/jactionlint`, then `brew install --cask jdx/jactionlint/jactionlint`.
- **PyPI:** `uvx jactionlint` runs it without installing it, and `pipx install jactionlint` or `uv tool install jactionlint` installs it.
- **Docker:** the image `ghcr.io/jdx/jactionlint` also holds shellcheck and pyflakes. Run the image shows the command.
- **Go:** `go install github.com/jdx/jactionlint/v2/cmd/jactionlint@latest`.
- **Release archives:** download the archive for your platform from the releases and verify it.
Packages named `actionlint`, as in Homebrew core, install the original project, not this fork. Installation covers every method.
## Example
This workflow has a typo in a trigger, untrusted input in a script and an undefined matrix property. It also uses an action by tag and sets no permissions, timeout or concurrency group. Save it as `test.yaml`:
 [code] 
`jactionlint test.yaml` prints each finding with its position, a message, the line it points at and, in bracke