Repository navigation
feat(github-actions.actionlint): lint with jactionlint - #37
Merged
Merged
Conversation
Upstream actionlint (v1.7.12) has not caught up with recent actions: it still requires `app-id` for `actions/create-github-app-token@v3` and rejects `client-id`. Switch to jactionlint, an actively maintained fork that mise now recommends in place of actionlint. - Run `jactionlint` with its POSIX options and add a `profile` input. The default `correctness` profile runs the checks of the original actionlint, so existing callers get the same rules. - Map the finding severity to `::error`, `::warning` or `::notice`, and title annotations with the rule id. - Install `github:jdx/jactionlint` pinned to 2.1.0 in the integration workflow and pass the new `actionlint_profile` input. The backend is named explicitly because the pinned mise (v2026.9.2) predates the `jactionlint` registry entry. Input names are unchanged.
👋 Welcome! Looks like this is your first pull request.Hey, thanks for your contribution! Please give us a bit of time to review it. 😄 Please check out our contributing guidelines. |
github-actions
Bot
added
💾 actions
GitHub Actions Integration
✅ All 1 passed. |
This was referenced Oct 11, 2026
… name The default mise of `mise.setup-tools` is bumped to v2026.10.8 in #39, which knows the `jactionlint` registry entry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
👋 Background
Upstream
actionlinthas fallen behind recent actions. v1.7.12 still requiresapp-idforactions/create-github-app-token@v3and rejectsclient-id, the input that replaces it. mise has deprecatedactionlintin its registry in favor ofjdx/jactionlint(jdx/mise#13960), an actively maintained fork. Itscorrectnessprofile runs the checks of the original actionlint.What changed
github-actions.actionlintcomposite actionjactionlintwith its POSIX options (--no-color,--config-file=,--shellcheck=,--format=json).profileinput. It defaults tocorrectness, so existing callers keep the same rules.error→::error,warn→::warning, everything else →::notice), and use the rule id as the title.github-actions.integrationreusable workflowjactionlint(registry name, resolves togithub:jdx/jactionlint), pinned to2.1.0by default because jactionlint releases add checks.actionlint_profileinput and pass it to the action.actionlint_*) are unchanged. No caller passes them today.Notes
jactionlintregistry entry first shipped in mise v2026.10.3, andmise.setup-toolspins v2026.9.2 until chore(mise.setup-tools): bump the default mise to v2026.10.8 #39 bumps it to v2026.10.8. Merged before chore(mise.setup-tools): bump the default mise to v2026.10.8 #39, the integration workflow fails to install jactionlint in every caller repository. Checked locally: mise v2026.10.8 installsjactionlint@2.1.0by its short name and verifies its GitHub artifact attestation.@mainworkflow (upstream actionlint), so it does not exercise the change. Checked locally on macOS:runscripts, run against sample workflows with thecorrectnessandpedanticprofiles and with shellcheck on and off, produce the expected::error/::warninglines.yamllint,check-jsonschema(workflows and actions), andjactionlint --profile=correctnesspass on the changed files.app-idingithub.pr.claude-code.yamlas deprecated, so thepushrun onmainwill fail on that one finding. The follow-up PR moves it toclient-id. It is split out because upstream actionlint, which this PR's CI uses, rejectsclient-id.jactionlint --profile=correctnesson this repo's composite actions finds 21 issues (13 inmisc.string-interpolation, mostlytemplate-injection). That is out of scope here because this action only lints top-level workflow files.