actionlint
actionlint is a static checker for GitHub Actions workflow files.
What actionlint is
actionlint is a static checker for GitHub Actions workflow files. It checks workflow syntax for unexpected or missing keys and type-checks `${{ }}` expressions to flag semantic errors such as missing properties and type mismatches. It also validates action inputs and outputs, as well as inputs, outputs, and secrets in reusable workflows and workflow calls. Security checks include script injection risks involving untrusted inputs and hard-coded credentials. For scripts in `run:` steps, actionlint can integrate ShellCheck and Pyflakes; those integrations can be turned off. The project documents installation through prebuilt binaries, Docker, source builds, a CI download script, and package managers. A browser playground runs actionlint through WebAssembly and states that it does not send data outside the browser. Documented integrations include reviewdog, GitHub Problem Matchers, super-linter, pre-commit, several editors, and trunk. The project also provides Go APIs and configuration for self-hosted runner labels, configuration variables, and file-specific error ignore patterns. actionlint is free and distributed under the MIT license, with a command-line tool and browser playground.
Good
- Checks workflow syntax and strongly type-checks expressions.
- Validates action and reusable workflow inputs, outputs, and secrets.
- Flags script injection risks and hard-coded credentials.
- Browser playground runs without sending data outside the browser.
Watch out
- ShellCheck and Pyflakes integrations are limited to scripts in run steps.
- 6803 debugging is not implemented.
Who it suits
actionlint suits developers who maintain GitHub Actions workflows and want checks for syntax, expressions, workflow interfaces, and security risks. It also fits teams seeking command-line, browser, editor, or CI integration options.
Verdict
actionlint offers workflow validation, expression checks, and security checks, with command-line, browser, editor, and CI integration options. Its ShellCheck and Pyflakes integrations apply to scripts in `run:` steps and can be disabled.
Plans and prices
From actionlint's own pricing page, checked 11 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| actionlint | Free | MIT-licensed static checker · command-line tool and browser playground |
The facts
Each one read from actionlint's own pages, with the date it was checked.
What it does
- Action and workflow validation
- It checks action inputs and outputs, as well as inputs, outputs, and secrets in reusable workflows and workflow calls.checked 11 Oct 2026
- Configuration
- The README says configuration can set self-hosted runner labels, configuration variables, and error ignore patterns by file path.checked 11 Oct 2026
- Developer integrations
- The usage guide describes integrations with reviewdog, GitHub Problem Matchers, super-linter, pre-commit, VS Code, Emacs, Vim and Neovim, Pulsar Edit, Nova, and trunk.checked 11 Oct 2026
- Expression checks
- It strongly type-checks `${{ }}` expressions to catch semantic errors such as missing properties and type mismatches.checked 11 Oct 2026
- Go library
- The project provides Go APIs for using actionlint from a Go program.checked 11 Oct 2026
- Install and run
- The project documents prebuilt binaries, Docker, building from source, a CI download script, and package-manager installation options.checked 11 Oct 2026
- License
- The project is distributed under the MIT license.checked 11 Oct 2026
- Online playground
- The browser playground runs actionlint through WebAssembly and states that it never sends data outside the browser.checked 11 Oct 2026
- Purpose
- actionlint is a static checker for GitHub Actions workflow files.checked 11 Oct 2026
- Security checks
- Its security checks include detecting script injection risks from untrusted inputs and hard-coded credentials.checked 11 Oct 2026
- Shell and Python integrations
- It can integrate ShellCheck and Pyflakes for scripts in `run:` steps; these integrations can be disabled.checked 11 Oct 2026
- Support and feedback
- The README invites bug reports and feedback, including feature requests and ideas for additional checks, through GitHub issues.checked 11 Oct 2026
- Workflow checks
- It checks workflow syntax, including unexpected or missing keys.checked 11 Oct 2026
Alternatives to actionlint
- 1
Cppcheck
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.4Free plan - 2
JSHint
Free planOpen sourceWebAPIExtensionLinux7.4Free plan - 3
Flake8
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 4
PMD
Free planLinuxmacOSSelf-hostedWindows6.8Free plan - 5
SwiftLint
Free planLinuxmacOSWindows6.6Free plan - 6
Ruff
Free planWebLinuxmacOSSelf-hosted6.5Free plan