Pull Requests | Issues | v1.5.2...v1.5.3

#967 Fix Homebrew tap to remove the quarantine bit from the binary on a post install hook

Pull Requests | Issues | v1.5.1...v1.5.2

#962 Update Go to v1.24.5
#962 Release SBOM
#962 Add license files of Go and Go Modules to released assets

v1.5.1...v1.5.2-0

Pull Requests | Issues | v1.5.0...v1.5.1

🐛 Bug Fixes

#933 Fix a bug of ghalint exp validate-input that reusable workflows' required inputs aren't validated

Pull Requests | Issues | v1.4.1...v1.5.0

Features

#904 Add experimental commands to validate actions and reusable workflows' inputs

Adding the following experimental commands:

• ghalint exp validate-input
• ghalint exp token set
• ghalint exp token rm

$ ghalint exp validate-input
ERRO[0000] invalid input key                             action=suzuki-shunsuke/actionlint-action@c8d3c0dcc9152f1d1c7d4a38cbf4953c3a55953d input_key=actionlint_option job_key=actionlint program=ghalint required_inputs= valid_inputs="sparse-checkout, actionlint_options" version=v1.0.0-local workflow_file_path=.github/workflows/actionlint.yaml

ghalint exp validate-input command validates inputs of actions and reusable workflows.
It fails if required inputs aren't given or unknown inputs are passed.

By default, the following files are validated.

.github/workflows/*.yaml
.github/workflows/*.yml
action.yaml
action.yml
*/action.yaml
*/action.yml
*/*/action.yaml
*/*/action.yml
*/*/*/action.yaml
*/*/*/action.yml

This command uses a GitHub access token with contents:read permission to download actions and reusable workflows.
It downloads them into XDG_DATA_HOME/ghalint.
You can pass a GitHub access token by environment variables GITHUB_TOKEN or GHALINT_GITHUB_TOKEN.
You can also manage it by secret stores such as GNOME Keyring, Windows Credential Manager, and macOS Keychain.

ghalint exp token set [-stdin]

ghalint exp token rm # Remove a token from secret store

Pull Requests | Issues | v1.4.0...v1.4.1

🐛 Bug Fixes

#907 action_ref_should_be_full_length_commit_sha: Fix a bug that Docker Action isn't supported @ponko2

Pull Requests | Issues | v1.3.0...v1.4.0

Features

#895 Lint additional action.yaml @5ouma

ghalint lints the following action.yaml by default

action.yaml
action.yml
*/action.yaml
*/action.yml
*/*/action.yaml
*/*/action.yml
*/*/*/action.yaml
*/*/*/action.yml

#896 Find config files under the .github directory as well @5ouma

ghalint.yaml
.ghalint.yaml
.github/ghalint.yaml
ghalint.yml
.ghalint.yml
.github/ghalint.yml

Pull Requests | Issues | v1.2.4...v1.3.0

Features

#809 #812 Require actions/create-github-app-token's inputs permission-*

This release enhances the policy github_app_should_limit_permissions.

❌

- uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
  with:
    app-id: ${{vars.APP_ID}}
    private-key: ${{secrets.PRIVATE_KEY}}

⭕

- uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
  with:
    app-id: ${{vars.APP_ID}}
    private-key: ${{secrets.PRIVATE_KEY}}
    permission-issues: write

Pull Requests | Issues | v1.2.3...v1.2.4

🐛 Bug Fixes

#805 Fix a bug that ghalint fails if expressions are used in timeout-minutes

v1.2.3...v1.2.4-0