@kjanat/actionlint 1.15.0

package/LICENSE.txt

@@ -0,0 +1,22 @@
+the MIT License
+
+Copyright (c) 2026 Kaj Kowalski
+Copyright (c) 2021 rhysd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR
+THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+

package/README.md

@@ -0,0 +1,105 @@
+# @kjanat/actionlint
+
+Static checker for GitHub Actions workflow files, distributed as a prebuilt binary.
+
+This is the npm distribution of [`kjanat/actionlint`](https://github.com/kjanat/actionlint), a fork of
+[rhysd/actionlint](https://github.com/rhysd/actionlint). Installing it puts an `actionlint` executable on your `PATH`; no
+Go toolchain is needed.
+
+## Install
+
+```sh
+npm install --save-dev @kjanat/actionlint
+```
+
+Or run it without installing:
+
+```sh
+npx @kjanat/actionlint
+```
+
+## Usage
+
+Run it in a repository and it finds the workflows itself:
+
+```sh
+npx actionlint
+```
+
+As a package script:
+
+```json
+{
+  "scripts": {
+    "lint:workflows": "actionlint"
+  }
+}
+```
+
+`actionlint` exits `0` when it finds nothing, `1` when it reports problems, and `2` or `3` on a usage error or a fatal
+error. Those statuses are forwarded verbatim, so it drops into CI unchanged.
+
+See the [usage documentation](https://github.com/kjanat/actionlint/blob/master/docs/usage.md) for the full command line,
+and [the checks list](https://github.com/kjanat/actionlint/blob/master/docs/checks.md) for what it looks for.
+
+The manual page ships in the package as `man/actionlint.1`. npm registered man pages with the system `man` program up to
+v11; from v12 it no longer does, so on a current npm read it directly:
+
+```sh
+man ./node_modules/@kjanat/actionlint/man/actionlint.1
+```
+
+### ShellCheck and Pyflakes
+
+`actionlint` also checks the shell scripts inside `run:` steps with [ShellCheck][shellcheck], and Python scripts with
+[Pyflakes][pyflakes], when those are on your `PATH`. Neither is bundled here; install them separately to enable those
+checks.
+
+## How this package is put together
+
+This package contains no binary itself. It declares one `optionalDependencies` entry per platform, each published
+under the `@kjanat-actionlint` scope so the binaries stay out of the `@kjanat` namespace:
+
+| Package                                      | Runs on               |
+| -------------------------------------------- | --------------------- |
+| `@kjanat-actionlint/actionlint-linux-x64`    | Linux x86-64          |
+| `@kjanat-actionlint/actionlint-linux-arm64`  | Linux ARM64           |
+| `@kjanat-actionlint/actionlint-darwin-x64`   | macOS Intel           |
+| `@kjanat-actionlint/actionlint-darwin-arm64` | macOS Apple silicon   |
+| `@kjanat-actionlint/actionlint-win32-x64`    | Windows x86-64        |
+| `@kjanat-actionlint/actionlint-win32-arm64`  | Windows ARM64         |
+| `@kjanat-actionlint/actionlint-linux-ia32`   | Linux 32-bit x86      |
+| `@kjanat-actionlint/actionlint-linux-arm`    | Linux ARMv6 and ARMv7 |
+| `@kjanat-actionlint/actionlint-win32-ia32`   | Windows 32-bit x86    |
+| `@kjanat-actionlint/actionlint-freebsd-x64`  | FreeBSD x86-64        |
+| `@kjanat-actionlint/actionlint-freebsd-ia32` | FreeBSD 32-bit x86    |
+
+Each declares `os` and `cpu`, so your package manager downloads only the one matching your machine and skips the rest.
+The `actionlint` command here is a small launcher that resolves that package and execs the binary inside it.
+
+There is no separate musl build: the binaries are statically linked, so the `linux-*` packages run on Alpine and on
+glibc distributions alike.
+
+The binaries are the same ones attached to the [GitHub release][releases]; each archive is verified against the
+release's published checksums before being repackaged.
+
+### If the binary is not found
+
+The launcher fails with an explanation, but the usual cause is a package manager that skipped optional dependencies.
+Reinstall without `--no-optional` or `--omit=optional`.
+
+Using Bun with `minimumReleaseAge`? Add `@kjanat-actionlint/*` to `minimumReleaseAgeExcludes` alongside
+`@kjanat/actionlint`. A fresh release otherwise installs the facade while its binaries are still age-gated.
+
+## Other ways to install
+
+Homebrew, Arch (AUR), Scoop, Docker, a download script, and `go install` are all covered in
+[the installation documentation](https://github.com/kjanat/actionlint/blob/master/docs/install.md).
+
+## License
+
+MIT. See [LICENSE.txt](./LICENSE.txt).
+
+[pyflakes]: https://pypi.org/project/pyflakes/
+[releases]: https://github.com/kjanat/actionlint/releases
+[shellcheck]: https://www.shellcheck.net/

package/bin/actionlint.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import launch from '#launch';
+
+launch('actionlint');

package/lib/launch.mjs

@@ -0,0 +1,34 @@
+import { resolveBinary } from '#resolve';
+import { spawnSync } from 'node:child_process';
+import process from 'node:process';
+
+const { argv, exit, stderr } = process;
+
+/**
+ * Run the prebuilt binary for this host, forwarding argv, stdio and exit status.
+ *
+ * @param {string} name - Base name of the executable, without any extension.
+ * @returns {void}
+ */
+export default function launch(name) {
+	try {
+		const result = spawnSync(resolveBinary(name), argv.slice(2), {
+			stdio: 'inherit',
+			windowsHide: false,
+		});
+		if (result.error) throw result.error;
+		// Re-raise the child's signal on ourselves; `set -e`, traps and Ctrl+C
+		// chaining read WIFSIGNALED / 128 + N. POSIX only, Windows falls through.
+		if (result.signal && process.platform !== 'win32') {
+			process.removeAllListeners(result.signal);
+			process.kill(process.pid, result.signal);
+			return;
+		}
+		// actionlint exits 1 when it finds problems and 2/3 on bad usage or a
+		// fatal error, so the status has to be forwarded verbatim.
+		exit(result.status ?? 1);
+	} catch (err) {
+		stderr.write(`${name}: ${err instanceof Error ? err.message : String(err)}\n`);
+		exit(1);
+	}
+}

package/lib/resolve.mjs

@@ -0,0 +1,185 @@
+import { cyan, link, red, yellow } from 'ansispeck';
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { arch, platform } from 'node:process';
+
+const require = createRequire(import.meta.url);
+const { bugs, name: pkgName, optionalDependencies } = require('#pkg');
+
+const issues = bugs.url;
+const declared = Object.keys(optionalDependencies || {});
+
+/**
+ * `existsSync` that never throws; a locked-down root can raise on a stat.
+ *
+ * @param {string} path
+ * @returns {boolean}
+ */
+function exists(path) {
+	try {
+		return existsSync(path);
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * Name of the platform package holding the build for a host.
+ *
+ * The `<scope>/<binary>-<os>-<cpu>` convention is the contract. The platform
+ * packages live in their own scope, apart from the facade.
+ *
+ * There is no libc dimension. The release binaries are built with
+ * `CGO_ENABLED=0`, so one `linux-<cpu>` package covers glibc and musl hosts,
+ * Alpine included. A Rust equivalent has to detect the host libc and pick
+ * between a gnu and a musl build.
+ *
+ * @param {string} scope - npm scope the platform packages are published under.
+ * @param {string} binary - Base name of the executable.
+ * @param {string} os - Node `platform` string.
+ * @param {string} cpu - Node `arch` string.
+ * @returns {string}
+ */
+export function platformPackage(scope, binary, os, cpu) {
+	return `${scope}/${binary}-${os}-${cpu}`;
+}
+
+/**
+ * Find the declared platform package for a host by its `-<os>-<cpu>` tail.
+ *
+ * The scope comes from the declaration itself; the facade carries no copy of
+ * it. Matching is by name, independent of `optionalDependencies` order.
+ *
+ * @param {readonly string[]} packages - Declared platform packages.
+ * @param {string} binary - Base name of the executable.
+ * @param {string} os
+ * @param {string} cpu
+ * @returns {string | undefined}
+ */
+function declaredPackage(packages, binary, os, cpu) {
+	const suffix = `/${binary}-${os}-${cpu}`;
+	return packages.find((pkg) => pkg.endsWith(suffix));
+}
+
+/**
+ * Report that this platform has no build at all, then throw.
+ *
+ * @param {string} os
+ * @param {string} cpu
+ * @param {readonly string[]} packages
+ * @returns {never}
+ */
+function failUnsupported(os, cpu, packages) {
+	const indent = '  ';
+	const supported = packages
+		.map((pkg) => pkg.slice(pkg.indexOf('/') + 1).replace(/^[^-]+-/, ''))
+		.sort()
+		.join(', ');
+
+	console.error(
+		`${red(pkgName)}: no build is published for ${yellow(`${os}-${cpu}`)}.
+
+Published platforms: ${cyan(supported)}
+
+Workarounds:
+${indent}- build from source, which works anywhere Go does: ${
+			cyan('go install actionlint.kjanat.dev/cmd/actionlint@latest')
+		}
+${indent}- ask for this platform: ${link(issues, issues)}
+`,
+	);
+
+	throw new Error(`No published build for ${os}-${cpu}.`);
+}
+
+/**
+ * Report that the matching platform package is unusable, then throw.
+ *
+ * The two ways it can be unusable need different fixes (install it, reinstall
+ * it), and `summary` carries that into the thrown error as well as the
+ * diagnostic block. A stack trace or CI log may keep only the thrown message.
+ *
+ * @param {string} wanted
+ * @param {string} detail - Why it is unusable, shown in the diagnostic.
+ * @param {string} summary - One-line reason carried by the thrown error.
+ * @returns {never}
+ */
+function failNotInstalled(wanted, detail, summary) {
+	const indent = '  ';
+
+	console.error(
+		`${red(pkgName)}: the platform package for this host is not usable.
+
+Expected package: ${cyan(wanted)}
+${indent}- ${detail}
+
+This usually means your package manager skipped ${cyan('optionalDependencies')}
+(common with ${cyan('--no-optional')}, ${cyan('--omit=optional')}, or some Docker and CI setups).
+
+Workarounds:
+${indent}- reinstall without ${cyan('--no-optional')} / ${cyan('--omit=optional')}
+${indent}- install it explicitly: ${cyan(`npm install ${wanted}`)}
+${indent}- bun + ${cyan('minimumReleaseAge')}: add ${cyan(`${wanted.slice(0, wanted.indexOf('/'))}/*`)} alongside ${
+			cyan(pkgName)
+		} in ${cyan('minimumReleaseAgeExcludes')}; a fresh release is otherwise age-gated
+${indent}- build from source instead: ${cyan('go install actionlint.kjanat.dev/cmd/actionlint@latest')}
+${indent}- file an issue: ${link(issues, issues)}
+`,
+	);
+
+	throw new Error(`${summary} (${wanted})`);
+}
+
+/**
+ * Locate the prebuilt executable matching the current platform and architecture.
+ *
+ * @param {string} name - Base name of the executable, without any extension.
+ * @param {object} [context] - Host details to resolve against; defaults to this process.
+ * @param {string} [context.platform] - Node `platform` string.
+ * @param {string} [context.arch] - Node `arch` string.
+ * @param {readonly string[]} [context.packages] - Declared platform packages.
+ * @param {(pkg: string) => string} [context.resolvePackageJson]
+ * @param {(path: string) => boolean} [context.fileExists]
+ * @returns {string} Filesystem path to the executable.
+ * @throws {Error} If no usable binary is installed for this host.
+ */
+export function resolveBinary(name, context = {}) {
+	const {
+		platform: hostPlatform = platform,
+		arch: hostArch = arch,
+		packages = declared,
+		resolvePackageJson = (pkg) => require.resolve(`${pkg}/package.json`),
+		fileExists = exists,
+	} = context;
+
+	const wanted = declaredPackage(packages, name, hostPlatform, hostArch);
+	// Absent from the manifest means no build exists for this host at all,
+	// which is a different problem from one that exists but was not installed.
+	if (!wanted) failUnsupported(hostPlatform, hostArch, packages);
+
+	let pkgJsonPath;
+	try {
+		pkgJsonPath = resolvePackageJson(wanted);
+	} catch (err) {
+		failNotInstalled(
+			wanted,
+			`not installed (${err instanceof Error ? err.message.split('\n')[0] : String(err)})`,
+			'The platform package is not installed',
+		);
+	}
+
+	const exe = hostPlatform === 'win32' ? `${name}.exe` : name;
+	const binPath = join(dirname(pkgJsonPath), 'bin', exe);
+	// Resolving package.json proves the package exists; the binary is separate.
+	// A half-succeeded install or a hand-deleted bin makes them disagree.
+	if (!fileExists(binPath)) {
+		failNotInstalled(
+			wanted,
+			`installed, but its binary is missing at ${binPath}`,
+			'The platform package is installed but its binary is missing',
+		);
+	}
+
+	return binPath;
+}

package/man/actionlint.1

@@ -0,0 +1,510 @@
+.\" Automatically generated by Pandoc 3.11
+.\"
+.TH "ACTIONLINT" "1" "" "actionlint 1.15.0" "General Commands Manual"
+.SH NAME
+\f[B]actionlint\f[R] \- static checker for GitHub Actions workflow files
+.SH SYNOPSIS
+\f[B]actionlint\f[R] [\f[I]flags\f[R]]
+.PD 0
+.P
+.PD
+\f[B]actionlint\f[R] [\f[I]flags\f[R]] \f[I]file\f[R]...
+.PD 0
+.P
+.PD
+\f[B]actionlint\f[R] [\f[I]flags\f[R]] \-
+.SH DESCRIPTION
+\f[B]actionlint\f[R] checks GitHub Actions workflow files without
+executing the workflows.
+This is the maintained \f[B]kjanat/actionlint\f[R] fork, distributed as
+the Go module \f[B]actionlint.kjanat.dev\f[R].
+.PP
+Checks include workflow syntax, expression types and context
+availability, action inputs and outputs, local action metadata and
+composite steps, reusable workflow inputs and permissions, job
+dependencies, parallel steps, runner labels, event filters, schedules,
+and YAML anchors.
+Security checks report potentially unsafe expression interpolation in
+scripts and hard\-coded credentials.
+Optional ShellCheck and pyflakes integrations check scripts in
+\f[B]run:\f[R] steps.
+.PP
+Repository policy checks can require immutable action references, job
+timeouts, and particular actions.
+These checks are enabled explicitly in the configuration file; ordinary
+workflow checks do not require configuration.
+.SH USAGE
+With no file arguments, \f[B]actionlint\f[R] searches the current
+directory and its parents for a repository containing both
+\f[B].git\f[R] and \f[B].github/workflows\f[R].
+It recursively checks \f[B].yml\f[R] and \f[B].yaml\f[R] files in that
+workflow directory:
+.IP
+.EX
+$ actionlint
+.EE
+.PP
+To check specific workflow files, pass their paths.
+Explicit files can be outside a repository:
+.IP
+.EX
+$ actionlint file1.yaml file2.yaml
+.EE
+.PP
+Pass \f[B]\-\f[R] as the only file argument to read a workflow from
+standard input:
+.IP
+.EX
+$ actionlint \-
+.EE
+.PP
+Use \f[B]\-stdin\-filename\f[R] to label diagnostics.
+If that path exists in a detected repository, actionlint also uses its
+repository configuration and local action metadata.
+For an unsaved file, select configuration explicitly with
+\f[B]\-config\-file\f[R] when needed:
+.IP
+.EX
+$ actionlint \-stdin\-filename .github/workflows/ci.yml \- < .github/workflows/ci.yml
+$ actionlint \-config\-file .github/actionlint.yaml \- < /tmp/workflow.yml
+.EE
+.PP
+Local action metadata and reusable workflows are read from disk when
+referenced by a workflow.
+Passing an \f[B]action.yml\f[R] file directly does not select a
+standalone action\-metadata lint mode.
+.PP
+Place flags before file arguments.
+Both \f[B]\-flag\f[R] and \f[B]\-\-flag\f[R] spellings are accepted, and
+a value can follow a flag or an equals sign.
+Use \f[B]\-\-\f[R] to end flag parsing before a filename that starts
+with a dash.
+Boolean flags accept \f[B]=true\f[R] or \f[B]=false\f[R].
+.PP
+Use \f[B]\-format\f[R] to serialize diagnostics or customize their
+presentation with Go templates:
+.IP
+.EX
+$ actionlint \-format \(aq{{json .}}\(aq
+.EE
+.SH FLAGS
+.TP
+\f[B]\-color\f[R]
+Force colored output, including when standard output is redirected.
+\f[B]\-no\-color\f[R] takes precedence if both flags are set.
+.TP
+\f[B]\-completion\f[R] \f[I]SHELL\f[R]
+Print a shell completion script for the given shell to stdout.
+One of \f[B]bash\f[R], \f[B]fish\f[R], \f[B]powershell\f[R],
+\f[B]zsh\f[R].
+Also accepted are \f[B]pwsh\f[R], a shell path such as \f[B]$SHELL\f[R],
+and \f[B]auto\f[R] to detect the current shell from \f[B]SHELL\f[R],
+falling back to PowerShell when \f[B]PSModulePath\f[R] is set.
+Prints the script and exits without linting.
+See SHELL COMPLETION below.
+.TP
+\f[B]\-config\-file\f[R] \f[I]PATH\f[R]
+Read configuration from \f[I]PATH\f[R] instead of using the detected
+repository\(aqs configuration.
+Relative paths are resolved from the current working directory.
+.TP
+\f[B]\-debug\f[R]
+Write development diagnostics to standard error.
+Use without \f[B]\-verbose\f[R], which takes precedence when both flags
+are set.
+.TP
+\f[B]\-format\f[R] \f[I]FORMAT\f[R]
+Format diagnostics using a Go text template.
+The template receives a sequence of error objects.
+See OUTPUT below.
+This overrides \f[B]\-oneline\f[R].
+.TP
+\f[B]\-ignore\f[R] \f[I]PATTERN\f[R]
+Suppress diagnostics whose message matches \f[I]PATTERN\f[R], using Go
+regular expression syntax.
+Repeat the flag to match any of several patterns:
+\f[B]\-ignore A \-ignore B\f[R] suppresses messages matching either
+pattern.
+Suppressed diagnostics do not cause exit status 1.
+.TP
+\f[B]\-init\-config\f[R]
+Create \f[B].github/actionlint.yaml\f[R] in the detected repository and
+exit without linting.
+Includes the YAML Language Server schema directive for editor
+completion, hover documentation, and validation.
+Requires a repository with \f[B].github/workflows\f[R] and refuses to
+overwrite either supported configuration filename.
+.TP
+\f[B]\-no\-color\f[R]
+Disable colored output, even when \f[B]\-color\f[R] is also set.
+.TP
+\f[B]\-oneline\f[R]
+Print one line per diagnostic, without the source snippet and position
+marker.
+.TP
+\f[B]\-pyflakes\f[R] \f[I]COMMAND\f[R]
+Command used to check Python \f[B]run:\f[R] scripts.
+Accepts an executable name, a path, or a quoted command line such as
+\f[B]\(dqpython3 \-m pyflakes\(dq\f[R] or
+\f[B]\(dquvx pyflakes\(dq\f[R].
+Defaults to \f[B]pyflakes\f[R]; \f[B]\-pyflakes=\f[R] disables the
+integration.
+.TP
+\f[B]\-shellcheck\f[R] \f[I]COMMAND\f[R]
+Command used to check supported shell \f[B]run:\f[R] scripts.
+Accepts an executable name, a path, or a quoted command line such as
+\f[B]\(dqshellcheck \-e SC2086\(dq\f[R].
+Defaults to \f[B]shellcheck\f[R]; \f[B]\-shellcheck=\f[R] disables the
+integration.
+.TP
+\f[B]\-stdin\-filename\f[R] \f[I]NAME\f[R]
+Filename used for standard\-input diagnostics.
+Defaults to \f[B]<stdin>\f[R].
+An existing path also allows repository discovery; see USAGE above.
+.TP
+\f[B]\-verbose\f[R]
+Write progress information to standard error, including file discovery
+and disabled external linter integrations.
+.TP
+\f[B]\-version\f[R]
+Print the build\(aqs module name and version, installation source, Go
+compiler version, and target operating system and architecture, then
+exit.
+.TP
+\f[B]\-help\f[R], \f[B]\-h\f[R]
+Print command usage and flags to standard error, then exit successfully.
+.SH CONFIGURATION
+Configuration is optional.
+In a detected repository, actionlint reads
+\f[B].github/actionlint.yaml\f[R], or \f[B].github/actionlint.yml\f[R]
+if the first filename is absent.
+\f[B]\-config\-file\f[R] selects a different file; settings are not
+merged with the repository file or a user\-global configuration.
+.PP
+The available settings are:
+.TP
+\f[B]self\-hosted\-runner.labels\f[R]
+Additional runner\-label patterns.
+Patterns use Go \f[B]path.Match\f[R] glob syntax.
+.TP
+\f[B]config\-variables\f[R]
+Allowed names in the \f[B]vars\f[R] context.
+Omitted or \f[B]null\f[R] disables this check; an empty list allows no
+configuration variables.
+.TP
+\f[B]config\-secrets\f[R]
+Allowed secret names, compared case\-insensitively.
+Omitted or \f[B]null\f[R] disables this check.
+The built\-in secrets \f[B]GITHUB_TOKEN\f[R],
+\f[B]ACTIONS_STEP_DEBUG\f[R], and \f[B]ACTIONS_RUNNER_DEBUG\f[R], and
+secrets declared in \f[B]on.workflow_call.secrets\f[R], remain allowed
+even with an empty list.
+.TP
+\f[B]assume\-default\-permissions\f[R]
+Permission assumption for a local reusable workflow call when neither
+the calling job nor its workflow declares \f[B]permissions\f[R].
+Defaults to \f[B]restricted\f[R], which assumes read access to
+\f[B]contents\f[R] and \f[B]packages\f[R].
+\f[B]permissive\f[R] assumes write access; \f[B]id\-token\f[R] still
+requires an explicit grant.
+This setting does not change the repository\(aqs actual GitHub
+permissions.
+.TP
+\f[B]paths\f[R]
+Map repository\-relative glob patterns to configuration.
+Patterns use \f[B]/\f[R] separators and support \f[B]**\f[R] and brace
+alternatives.
+Each entry\(aqs \f[B]ignore\f[R] list contains message regular
+expressions, applied in addition to \f[B]\-ignore\f[R].
+.TP
+\f[B]policy.require\-commit\-hash\f[R]
+When \f[B]true\f[R], require action and reusable workflow references to
+use 40\- or 64\-digit hexadecimal commit IDs, and \f[B]docker://\f[R]
+images to use digests.
+Local references and expression\-based references are skipped.
+.TP
+\f[B]policy.require\-job\-timeout\f[R]
+When \f[B]true\f[R], require \f[B]timeout\-minutes\f[R] on jobs that run
+steps.
+A mapping such as \f[B]{ max\-minutes: 60 }\f[R] also limits literal
+timeout values.
+Jobs calling reusable workflows are skipped; expression\-based timeouts
+are not compared with the maximum.
+.TP
+\f[B]policy.required\-actions\f[R]
+List actions every workflow must use.
+Entries accept name and ref glob patterns, such as
+\f[B]actions/checkout\f[R] or \f[B]my\-org/security\-scan\(atv2*\f[R].
+Only steps directly in the workflow are searched.
+Workflows consisting entirely of reusable workflow calls, or containing
+an expression\-based action reference, are skipped.
+.PP
+Policy checks are off until enabled.
+For example:
+.IP
+.EX
+self\-hosted\-runner: { labels: [linux.2xlarge] }
+config\-variables: [DEFAULT_RUNNER]
+config\-secrets: [DEPLOY_TOKEN]
+assume\-default\-permissions: restricted
+policy:
+  require\-commit\-hash: true
+  require\-job\-timeout: { max\-minutes: 60 }
+  required\-actions: [actions/checkout]
+paths:
+  \(dq.github/workflows/**/*.{yml,yaml}\(dq:
+    ignore: [\(aqshellcheck reported issue in this script: SC2086:.+\(aq]
+.EE
+.PP
+The repository supplies \f[B]actionlint.schema.json\f[R] for editor
+completion and validation.
+See the configuration document below for the schema URL and full
+matching rules.
+.SH EXTERNAL LINTERS
+ShellCheck checks supported shell scripts in \f[B]run:\f[R] steps;
+pyflakes checks Python scripts.
+The executables must be available through \f[B]PATH\f[R] or the
+corresponding command flag.
+If a command cannot be resolved, its integration is skipped;
+\f[B]\-verbose\f[R] explains why.
+.IP
+.EX
+$ actionlint \-shellcheck= \-pyflakes=
+$ actionlint \-shellcheck \(aqshellcheck \-e SC2086\(aq
+$ actionlint \-pyflakes \(aqpython3 \-m pyflakes\(aq
+.EE
+.PP
+Command strings are parsed into an executable and arguments, not
+executed by a shell.
+Shell pipes and redirections are not supported in these flags.
+Your arguments precede actionlint\(aqs own arguments, so do not supply
+input filenames or override ShellCheck\(aqs output format.
+.PP
+actionlint invokes ShellCheck with \f[B]\-\-norc\f[R] and JSON1 output,
+so \f[B].shellcheckrc\f[R] is not read.
+Use \f[B]\-shellcheck\f[R] arguments or \f[B]SHELLCHECK_OPTS\f[R] for
+ShellCheck options.
+Filter pyflakes diagnostics with \f[B]\-ignore\f[R] or the
+configuration\(aqs \f[B]paths\f[R] entries.
+.SH OUTPUT
+Diagnostics go to standard output.
+Command usage, progress logs, and fatal errors go to standard error.
+The default diagnostic includes the file, line, column, message, rule
+name, and source snippet.
+\f[B]\-oneline\f[R] omits the snippet; \f[B]\-format\f[R] replaces the
+diagnostic presentation.
+.PP
+The Go template receives a sequence of errors.
+Each has \f[B]Message\f[R], \f[B]Snippet\f[R], \f[B]Kind\f[R],
+\f[B]Filepath\f[R], \f[B]Line\f[R], \f[B]Column\f[R], and
+\f[B]EndColumn\f[R] fields.
+Line and column numbers start at 1.
+Custom template functions include \f[B]json\f[R], \f[B]replace\f[R],
+\f[B]toPascalCase\f[R], \f[B]allKinds\f[R], and \f[B]getVersion\f[R].
+.PP
+JSON:
+.IP
+.EX
+$ actionlint \-format \(aq{{json .}}\(aq
+.EE
+.PP
+JSON Lines:
+.IP
+.EX
+$ actionlint \-format \(aq{{range .}}{{json .}}{{end}}\(aq
+.EE
+.PP
+Custom lines:
+.IP
+.EX
+$ actionlint \-format \(aq{{range .}}{{.Filepath}}:{{.Line}}:{{.Column}}: {{.Message}} [{{.Kind}}]\(rsn{{end}}\(aq
+.EE
+.PP
+Backslash escapes such as \f[B]\(rsn\f[R] in the format string are
+expanded before the template is parsed.
+.PP
+For SARIF, pass the contents of \f[B]sarif_template.txt\f[R] from the
+actionlint source repository to \f[B]\-format\f[R], for example in Bash:
+.IP
+.EX
+$ actionlint \-format \(dq$(cat sarif_template.txt)\(dq > actionlint.sarif
+.EE
+.PP
+The CLI\(aqs \f[B]\-format\f[R] accepts template text.
+The GitHub Action\(aqs \f[B]format\f[R] input instead accepts names such
+as \f[B]json\f[R] and \f[B]sarif\f[R].
+Changing output format does not change the lint exit status.
+.SH SHELL COMPLETION
+\f[B]\-completion\f[R] generates native completion scripts for Bash,
+Fish, Zsh, and PowerShell.
+Scripts complete flags, flag values, and workflow paths.
+Load one into the current shell session:
+.PP
+Bash:
+.IP
+.EX
+$ source <(actionlint \-completion bash)
+.EE
+.PP
+Fish:
+.IP
+.EX
+$ actionlint \-completion fish | source
+.EE
+.PP
+Zsh, after initializing its completion system:
+.IP
+.EX
+$ autoload \-Uz compinit && compinit
+$ source <(actionlint \-completion zsh)
+.EE
+.PP
+PowerShell:
+.IP
+.EX
+actionlint \-completion powershell | Out\-String | Invoke\-Expression
+.EE
+.PP
+For persistent installation, save Bash output in a directory loaded by
+bash\-completion, Fish output as
+\f[B]\(ti/.config/fish/completions/actionlint.fish\f[R], or Zsh output
+as \f[B]_actionlint\f[R] in a directory on \f[B]fpath\f[R].
+Load PowerShell output from your profile.
+Regenerate saved scripts after upgrading actionlint so they reflect the
+installed CLI.
+See the usage document for setup examples.
+.SH ENVIRONMENT
+.TP
+\f[B]PATH\f[R]
+Used to find ShellCheck and pyflakes, including the executable selected
+by their command flags.
+.TP
+\f[B]NO_COLOR\f[R]
+A nonempty value disables automatic color.
+\f[B]\-color\f[R] can force color; \f[B]\-no\-color\f[R] always disables
+it.
+.TP
+\f[B]SHELL\f[R], \f[B]PSModulePath\f[R]
+Used by \f[B]\-completion auto\f[R].
+A supported shell named by \f[B]SHELL\f[R] takes precedence over the
+PowerShell fallback indicated by a nonempty \f[B]PSModulePath\f[R].
+.TP
+\f[B]SHELLCHECK_OPTS\f[R]
+Additional options interpreted by the external ShellCheck process.
+.SH FILES
+.TP
+\f[B].github/workflows/\f[R]
+Workflow directory scanned when no filenames are provided.
+.TP
+\f[B].github/actionlint.yaml\f[R], \f[B].github/actionlint.yml\f[R]
+Optional repository configuration; the \f[B].yaml\f[R] spelling takes
+precedence.
+.SH DOCUMENTS
+Detailed documentation for this release is available online.
+.SS Checks
+https://github.com/kjanat/actionlint/blob/v1.15.0/docs/checks.md
+.PP
+Full list of all checks done by actionlint with example inputs, outputs,
+and playground links.
+.SS Installation
+https://github.com/kjanat/actionlint/blob/v1.15.0/docs/install.md
+.PP
+Installation instructions.
+Prebuilt binaries, Homebrew package, building from source, a Docker
+image, a download script (for CI) are available.
+.SS Usage
+https://github.com/kjanat/actionlint/blob/v1.15.0/docs/usage.md
+.PP
+CLI usage, shell completion, output templates, the GitHub Action, Docker
+images, and editor and CI integrations.
+.SS Configuration
+https://github.com/kjanat/actionlint/blob/v1.15.0/docs/config.md
+.PP
+Repository configuration, runner labels, variables, secrets, and opt\-in
+policy checks.
+.SS Go API
+https://github.com/kjanat/actionlint/blob/v1.15.0/docs/api.md
+.PP
+How to use actionlint as Go library.
+.SS References
+https://github.com/kjanat/actionlint/blob/v1.15.0/docs/reference.md
+.PP
+Links to resources.
+.SH USAGE ON GITHUB ACTIONS
+The repository provides a GitHub Action with actionlint, ShellCheck, and
+pyflakes in a prebuilt Docker image.
+It reports GitHub annotations by default and fails when problems are
+found:
+.IP
+.EX
+name: Lint GitHub Actions workflows
+on: [push, pull_request]
+permissions: { contents: read }
+
+jobs:
+  actionlint:
+    runs\-on: ubuntu\-latest
+    steps:
+      \- uses: actions/checkout\(atv7
+        with: { persist\-credentials: false }
+      \- uses: kjanat/actionlint\(atv1
+.EE
+.PP
+The Docker action requires a Linux runner with a reachable Docker
+daemon.
+To run the binary directly, including on macOS, Windows with Bash, or a
+runner without a Docker daemon, use the download script:
+.IP
+.EX
+\- name: Check workflow files
+  run: |
+    bash <(curl \-fsSL https://raw.githubusercontent.com/kjanat/actionlint/HEAD/scripts/download\-actionlint.bash) latest
+    ./actionlint \-color
+  shell: bash
+.EE
+.PP
+The script accepts \f[B]latest\f[R] to resolve the newest release, or a
+specific version.
+Without a version argument, it uses the default recorded in the script.
+It writes the executable to the current directory and, on GitHub
+Actions, exposes its path as the \f[B]executable\f[R] step output.
+External linters must be available separately when using the binary.
+.SH EXIT STATUS
+\f[B]actionlint\f[R] command exits with one of the following exit
+statuses.
+.IP \(bu 2
+\f[B]0\f[R]: It ran successfully and no problem was found.
+.IP \(bu 2
+\f[B]1\f[R]: It ran successfully and some problem was found.
+.IP \(bu 2
+\f[B]2\f[R]: Command\-line flag parsing failed, for example because of
+an unknown flag or missing value.
+.IP \(bu 2
+\f[B]3\f[R]: Initialization or linting failed, for example because a
+file cannot be read, a project cannot be found, or a configuration,
+ignore pattern, or output template is invalid.
+.SH PLAYGROUND
+The WebAssembly playground runs actionlint in your browser.
+Workflow linting happens locally in the browser; it does not execute
+workflows or run the external ShellCheck and pyflakes programs.
+.PP
+https://kjanat.github.io/actionlint/
+.PP
+Paste a workflow into the editor to see diagnostics update as you type.
+Select a diagnostic to jump to its source position.
+.SH BUGS
+Report problems with this fork to its issue tracker.
+Include the output of \f[B]\-version\f[R], the relevant configuration,
+and a minimal workflow that reproduces the problem.
+.PP
+https://github.com/kjanat/actionlint/issues
+.SH COPYRIGHT
+\f[B]actionlint\f[R] is licensed under the MIT License.
+.PP
+Copyright (c) 2026 Kaj Kowalski
+.PD 0
+.P
+.PD
+Copyright (c) 2021 rhysd
+.PP
+https://github.com/kjanat/actionlint/blob/HEAD/LICENSE.txt

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "@kjanat/actionlint",
+  "version": "1.15.0",
+  "description": "Static checker for GitHub Actions workflow files",
+  "keywords": [
+    "actionlint",
+    "github-actions",
+    "workflow",
+    "linter",
+    "lint",
+    "static-analysis",
+    "cli",
+    "yaml",
+    "shellcheck"
+  ],
+  "homepage": "https://actionlint.kjanat.dev",
+  "bugs": {
+    "url": "https://github.com/kjanat/actionlint/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kjanat/actionlint.git"
+  },
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/sponsors/kjanat"
+  },
+  "license": "MIT",
+  "author": "Kaj Kowalski <info+actionlint@kajkowalski.nl>",
+  "type": "module",
+  "imports": {
+    "#launch": "./lib/launch.mjs",
+    "#pkg": "./package.json",
+    "#resolve": "./lib/resolve.mjs"
+  },
+  "exports": {
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "actionlint": "bin/actionlint.mjs"
+  },
+  "man": [
+    "./man/actionlint.1"
+  ],
+  "directories": {
+    "lib": "./lib",
+    "man": "./man"
+  },
+  "files": [
+    "bin/",
+    "lib/",
+    "man/",
+    "README.md",
+    "LICENSE.txt"
+  ],
+  "dependencies": {
+    "ansispeck": "^0.4.2"
+  },
+  "optionalDependencies": {
+    "@kjanat-actionlint/actionlint-darwin-arm64": "1.15.0",
+    "@kjanat-actionlint/actionlint-darwin-x64": "1.15.0",
+    "@kjanat-actionlint/actionlint-freebsd-ia32": "1.15.0",
+    "@kjanat-actionlint/actionlint-freebsd-x64": "1.15.0",
+    "@kjanat-actionlint/actionlint-linux-arm": "1.15.0",
+    "@kjanat-actionlint/actionlint-linux-arm64": "1.15.0",
+    "@kjanat-actionlint/actionlint-linux-ia32": "1.15.0",
+    "@kjanat-actionlint/actionlint-linux-x64": "1.15.0",
+    "@kjanat-actionlint/actionlint-win32-arm64": "1.15.0",
+    "@kjanat-actionlint/actionlint-win32-ia32": "1.15.0",
+    "@kjanat-actionlint/actionlint-win32-x64": "1.15.0"
+  },
+  "engines": {
+    "node": ">=18.20.0"
+  }
+}