tracking: ideas from actionlint, zizmor, ghalint, other analyzers and GitHub platform changes #167

Scope

These ideas come from the issues, PRs and discussions of other projects:

• rhysd/actionlint and the fork kjanat/actionlint
• zizmor (main after 1.30.1)
• ghalint, ghlint, pinact
• poutine, CodeQL actions queries, octoscan, sisakulint, Scorecard, Semgrep, gato-x
• GitHub's changelog and the workflow schema (workflow-v1.0.json)

Ideas that jactionlint already covers were dropped. Items marked repro were reproduced with a build of c7254590; the others are not measured. Each item should get its own issue or PR when someone picks it up. This issue only tracks them. It is separate from #121 and #107: items already listed there are not repeated here.

1. Bugs in jactionlint

• The Generate workflow has failed on every run since the rename (runs). go run ./scripts/generate-popular-actions -d exits 1 when it finds new major versions (actions/setup-java@v6, dawidd6/action-download-artifact@v22, …). As a result go generate never runs, and the popular-action, webhook and availability data stays frozen, even within known majors. Also check the "Not found" entries in the log (release-drafter@v8, claude-code-action@v2, …). (ci(generate): keep detecting new action releases from failing the data refresh #169, chore(generate): refresh the generated data and keep merge_group destroyed #172)
• The -latest runner labels map to old images (repro). In rule_runner_label.go, windows-latest maps to 2022 and macos-latest to macOS 15. (fix(runner-label): follow the images behind the -latest labels #171)
  • False conflicts: [windows-latest, windows-2025], [macos-latest, macos-26] and [windows-2025, windows-2025-vs2026].
  • A missed conflict: [windows-latest, windows-2022].
  • mutable-runner-label suggests the older image.
  • ubuntu-latest moves to 26.04 between 2026-10-19 and 2026-11-19 (runner-images#14748, #14167).
• The input checks for popular actions skip SHA pins and full semver refs (repro). actions/cache@<sha> # v4.2.4 and actions/cache@v4.2.4 with keys: give no finding, while @v4 is reported. The default profile requires SHA pins, so this silently turns off missing-action-input, unknown-action-input and deprecated-action-input. outdated-action-runner has the same gap (actionlint#622). Fix: take the major version from the version comment or the semver tag. (fix(action): check popular actions pinned to a full version or to a commit with a version comment #174)
• Whole-value expressions are rejected (repro). The runner schema gives these keys a context list, so an expression is valid there: (fix(parser): accept a whole mapping or list written as one expression where the schema allows it #178)
  • with: ${{ fromJSON(vars.W) }} and defaults: run: ${{ … }} are reported as workflow-syntax errors in the correctness profile (zizmor#1769).
  • strategy: ${{ fromJSON('…') }} gets a "scalar node" error and then undefined-property on matrix.*.
• False positives from schema drift (repro): (fix(syntax): accept keys and values the workflow schema allows but the docs do not list #170)
  • top-level description: (languageservices@50b08a3)
  • the stacked activity type of pull_request and pull_request_target (languageservices#384)
  • the drives permission scope (languageservices#380)
  • github.artifacts and github.artifacts_list
  • empty strings in choice options
  • snapshot.if with steps, env, job, runner, the status functions and hashFiles (runner#4443)
  • image_version.types
  • cancel-timeout-minutes
  • ${{ insert }} as a mapping key (actionlint#349)
• False negatives from schema drift (repro): (fix(syntax): report what the runner rejects in schedules, merge_group, self-repository uses and action.yml #186, chore(generate): refresh the generated data and keep merge_group destroyed #172) Not done: github.job_workflow_sha, where the sources disagree on whether it is populated.
  • a schedule entry without cron
  • merge_group: types: [destroyed]
  • $/ references with a missing directory, an @ref suffix or ../ (languageservices#381)
  • timeout-minutes on a composite step (actionlint#277)
  • ${{ env.X }} in the default of an action input
  • pre-if and post-if, which are never checked (languageservices#317)
  • github.job_workflow_sha, which is accepted but is always empty (languageservices#347)
• A conformance test against the runner's workflow-v1.0.json and action_yaml.json, at a pinned commit that is bumped weekly. It would compare the keys, allowed-values, context lists and whole-value expressions with the parser tables and availability.go. It would have caught most of the two items above; the webhook generator scrapes the docs, which lag the schema. (test(schema): compare the parser with the schemas of the runner at a pinned commit #198)
• The hooks in .pre-commit-hooks.yaml use files: ^\.github/workflows/, so editing an action.yml or dependabot.yml, which jactionlint lints, does not run them. (fix(pre-commit): run the hooks for action.yml and dependabot.yml, add a bundled-shellcheck hook #181)
• untrusted-checkout: (fix(untrusted-checkout): follow pull/N/head fetches, skip merged pull requests, count sed -f, awk -f, tar -P and unzip -: #175)
  • It misses git fetch origin pull/N/head:pr written without refs/ (repro).
  • It reports pull_request_target: closed with if: github.event.pull_request.merged == true (repro).
• missing-timeout reports a job whose steps all set timeout-minutes (repro; the exception of ghalint 012). (fix(missing-timeout): add accept-step-timeouts for jobs whose steps all set timeout-minutes #252)
• Small issues (repro): (feat(external-tools): say when shellcheck or pyflakes did not run #188) All three are fixed on main (checked 2026-10-13).
  • excessive-permissions prints an empty description for models: write.
  • A 64-hex (SHA-256) commit pin is reported as unpinned (runner#4347).
  • --shellcheck=/missing/path is ignored without a word.

2. Platform changes with dates

• The fork-PR protection of actions/checkout (changelog, enforced since 2026-07-20 on every floating major except v1). untrusted-checkout gives the same message with and without allow-unsafe-pr-checkout: true (repro). It should: (feat(untrusted-checkout): honor the fork pull request protection of actions/checkout #183, feat(untrusted-checkout): honor the fork pull request protection of actions/checkout #203)

  • report the opt-out on its own line;
  • say whether the checkout is blocked (a floating major), exploitable (the opt-out, or a SHA pin below v2.8.0, v3.7.0, v4.4.0, v5.1.0 or v6.1.0) or not covered (git or gh).

  Done in poutine#450; in progress in zizmor#2134.

• .github/workflows/actions.lock (technical preview, enforced on GHEC; zizmor#2371, codeql#22155). (feat(unpinned-uses): accept a ref which the Actions lock file pins to a commit #228, feat(actions-lock): lint GitHub's Actions lock file against the workflows #237)

  • unpinned-uses should accept the refs that the lock pins.
  • The pin fix must not inline a SHA there.
  • Report missing and stale entries.
  • With --online, check the locked commits.

• Node 20 was removed on 2026-09-23 (changelog). Warn on: (feat(deprecated-node-runtime): report a Node.js runtime that GitHub removed in the metadata of an action (pedantic) #225, feat(deprecated-node-runtime): report popular actions at majors that declare node20 (pedantic) #230, feat(deprecated-node-runtime): report the environment variables that chose the Node.js runtime (pedantic) #234)

  • runs.using: node20;
  • popular node20 majors (checkout@v4, codeql-action@v3, …);
  • ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION and FORCE_JAVASCRIPT_ACTIONS_TO_NODE24, which no longer do anything.

• Runner labels being retired: (feat(runner-label): warn ahead of the retirement of a runner label and name it afterwards #182)

  • Warn ahead of time for macos-14* (retires 2026-11-02, changelog) and ubuntu-22.04* (2027-04-17).
  • For a label already retired, name its replacement instead of listing every label.

• ubuntu-slim caps jobs at 15 minutes and has no Docker daemon. (feat(ubuntu-slim): report what the single-CPU runner cannot run #190)

  • Report a higher timeout-minutes, container:, services: and docker:// steps.
  • Cap the missing-timeout fix at 15 on that label.

• pull_request_target is disabled by default in public repositories from 2026-11-02 (changelog). Mention it in the dangerous-triggers message and the docs. (feat(dangerous-triggers): say what the token and the secrets can do, and make a workflow without privileges pedantic #189)

• Check whether GitHub now trims the trailing newline of a block if: (changelog 2026-01-29). If it does, if-always-true is a false positive for if: | (not confirmed). (fix(if-always-true): do not report the newlines at the end of a block scalar #226)

3. Security detection gaps

• untrusted-checkout on issue_comment (repro): /test bots that run gh pr checkout N or check out refs/pull/N/head, then build. Accept the gates of CodeQL's ControlChecks. poutine, CodeQL, octoscan and gato-x all cover this. (feat(untrusted-checkout): cover issue_comment workflows that build a pull request #193, feat(untrusted-checkout): cover issue_comment workflows that build a pull request #206)
• untrusted-checkout through local reusable workflows and composite actions (repro): with: ref: ${{ github.event.pull_request.head.sha }} → ref: ${{ inputs.ref }}. (feat(untrusted-checkout): follow the head of a pull request into local reusable workflows and composite actions #208)
• Actions that run workspace code: the list in untrusted_helpers.go has 4 entries (repro). Add the actions of poutine and CodeQL: setup-ruby with bundler-cache, build-push-action, goreleaser, megalinter, super-linter, checkov, sonar, cibuildwheel, maturin, cypress, … Or generate the list from LOTP (zizmor#1948). The same check should also catch tar -P, sed -f, awk -f and unzip -:. (feat(untrusted-checkout): count the actions that run the workspace, with the input that makes them do it #213)
• Command injection through env vars (repro): eval "$BODY", bash -c "…$BODY", a variable in command position, and execSync(process.env.X) in github-script (CodeQL CWE-078). (feat(command-injection): report input that a script runs as code after it moved to env #202)
• TOCTOU (repro): an environment: or label gate combined with a mutable head.ref, refs/pull/N/merge or gh pr checkout, or a label gate whose types: include synchronize (CodeQL CWE-367). (feat(untrusted-checkout): report gates that hold at one moment in front of code that can change, and labels that last #220)
• template-injection: free text written by outsiders is reported only by the pedantic tier (repro): changes.title.from, changes.body.from, head.repo.homepage, pages[*].title, workflow_run.path and merge_group.head_commit.message (CodeQL list). (feat(template-injection): report more free text of outsiders in the default profile #173)
• dangerous-triggers: take permissions: {}, read-only scopes and the absence of secrets into account (zizmor#398, 11 👍). (feat(dangerous-triggers): say what the token and the secrets can do, and make a workflow without privileges pedantic #189)
• Output clobbering (repro): untrusted name=value written to $GITHUB_OUTPUT (CodeQL). Today the github-env message presents GITHUB_OUTPUT as the safe channel. (feat(output-clobbering): report input with line breaks written to GITHUB_OUTPUT as a record #212, feat(environment-file-redirect): report writes to GITHUB_OUTPUT that lose the data #184)
• Taint sources inside scripts: gh pr view --json title and git log --format=%s (CodeQL models). Also follow PR refs from known actions (xt0rted/pull-request-comment-branch, github/branch-deploy). (feat(github-env): follow text that a script reads with gh and git #218) Not done: following pull request refs from xt0rted/pull-request-comment-branch and github/branch-deploy.
• self-hosted-runner (repro): (feat(self-hosted-runner): count the configured labels and runner groups, and say when a pull request reaches the runner #194)
  • Treat the labels configured in self-hosted-runner.labels and runs-on: {group:} as self-hosted (zizmor#2350).
  • Move the finding to the default profile when a pull request event reaches the runner (poutine pr_runs_on_self_hosted).
• unpinned-images: (feat(unpinned-images): check docker run images in scripts, add per-image policies and image allow/deny lists #211, feat(unpinned-images): pin container images to a digest with --online --fix=unsafe #239)
  • images in an object matrix, matrix.cfg.image (repro, zizmor#2395)
  • docker run and docker pull in scripts (zizmor#738)
  • per-registry policies (zizmor#737)
• cache-poisoning: add pnpm/setup, graalvm/setup-graalvm and ramsey/composer-install. (feat(cache-poisoning): add pnpm/setup, graalvm and composer, and report caches of credential files #216)
• untrusted-artifact: add aochmann/actions-download-artifact, bettermarks/action-artifact-download and blablacar/action-download-last-artifact (repro). (feat(untrusted-artifact): know more download actions and report a download of every artifact with the option pedantic #219)
• Secrets in a job's env: reach every step: an option of workflow-secret-scope (ghalint 006, zizmor#1816). (feat(workflow-secret-scope): job-level secrets, secrets passed to reusable workflows, and unused workflow_call secrets #223)
• dependabot-missing-actions-update: report local composite actions that directory: / does not reach (zizmor#1806). (feat(github-app): check two more token actions and cover local composite actions in dependabot-missing-actions-update #229)
• Comment-triggered jobs gated only on the comment body: reuse the user check of agentic-actions (zizmor#459). (feat(comment-trigger-authorization): report comment-triggered jobs that do not check who commented (pedantic) #217)
• github-app: also check tibdex/github-app-token and peter-murray/workflow-application-token-action. (feat(github-app): check two more token actions and cover local composite actions in dependabot-missing-actions-update #229)
• Pedantic candidates: (feat(unlocked-install): report npm, yarn and bun installs that run lifecycle scripts (pedantic) #187, feat(unlocked-install): report installs without a release-age cooldown (pedantic) #201, feat(use-trusted-publishing): report jobs that build, lack an environment or drop attestations (pedantic) #209, feat(comment-trigger-authorization): report comment-triggered jobs that do not check who commented (pedantic) #217, feat(unredacted-secrets): report values cut from a secret and printed by a script (pedantic) #222, feat(cache-poisoning): add pnpm/setup, graalvm and composer, and report caches of credential files #216, feat(workflow-secret-scope): job-level secrets, secrets passed to reusable workflows, and unused workflow_call secrets #223)
  • npm installs without --ignore-scripts (zizmor#1405)
  • installs without a release-age cooldown (#2044)
  • trusted publishing in a job that also builds (#1968)
  • caches holding credential files (#723)
  • secrets passed to a reusable call (#1792)
  • unused workflow_call.secrets (#1044)
  • secrets derived in the shell and then printed

4. New correctness checks

• gh in run: without GH_TOKEN (and without GH_REPO when there is no checkout) (repro; actionlint#246, ghlint MissingGhToken). superfluous-actions sends users to gh. (feat(gh-without-token): report the gh command without GH_TOKEN or GITHUB_TOKEN #177)

• Malformed expression delimiters (repro; actionlint#417, #169, ghlint#144): (feat(malformed-expression-delimiters): report ${ github.ref }, $ {{ x }} and {{ github.sha }} #180)

  • ${ github.ref }
  • $ {{ x }}
  • {{ github.sha }} (only with known context names)
  • a stray }}
  • $HOME in with: (pedantic)

• >> GITHUB_OUTPUT without $, which writes a file in the workspace, and a > that overwrites an earlier write in the same script (repro). (feat(environment-file-redirect): report writes to GITHUB_OUTPUT that lose the data #184)

• Permissions too narrow for well-known actions (ghlint#285): (feat(permissions): report a job whose permissions are too narrow for its actions #192)

  • upload-sarif needs security-events: write
  • deploy-pages needs pages and id-token
  • OIDC logins need id-token

  The same table could improve the missing-permissions fix. StepSecurity's knowledge base is AGPL, so the table has to be built independently.

• Concurrency deadlock when a caller and its callee resolve to the same group (repro; actionlint#538). (feat(concurrency-deadlock): report a group that a workflow shares with the workflow it calls #210)

• A run: written as a multi-line plain scalar (without |) is folded into one command (repro; actionlint#441). The fix adds |. (feat(multiline-plain-run): report a run folded into one line #205)

• github.event_name == 'x' where the workflow never receives x (repro; actionlint#68). (feat(event-name-never-received): report github.event_name compared with an event the workflow never receives #214)

• Fail-fast inputs: upload-artifact without if-no-files-found: error, and softprops/action-gh-release with fail_on_unmatched_files: false (zizmor#1208, ghlint). (feat(fail-fast-action-inputs): report actions that pass when nothing was produced #196)

• Inputs that only work together: download-artifact ignores run-id without github-token (ghlint#260). (feat(action-input-dependencies): report inputs of well-known actions that need each other #207)

• Later: (feat(undefined-property): check the properties of github.event against the webhook payloads #249, feat(macos-gnu-flags): report GNU-only options in run scripts of macOS jobs (pedantic) #241, feat(github-script-syntax): check the JavaScript of actions/github-script with node --check #242, feat(unmatched-paths-filter): report paths filters that match no file of the repository (pedantic) #238) Not done: array values in matrix.include (#630); a real run accepted arrays, so the premise was wrong.

  • type github.event by the triggers of the workflow (actionlint#39)
  • GNU-only flags in scripts on macOS runners
  • node --check for actions/github-script (actionlint#389)
  • array values in matrix.include (#630)
  • paths: globs that match no file (#430)

5. Online

• Fetch the action.yml or reusable workflow of any remote action at the pinned ref, then run the existing input, output and secret checks on it (actionlint#383, #669 👍33, #648 👍30; ghalint exp validate-input). The same lookup enables: (feat(action): check the inputs of any remote action against its action.yml with --online #231, feat(workflow-call): check the calls of reusable workflows of other repositories with --online #236, feat(unpinnable-action): report a hash-pinned action whose own dependencies are not pinned #240) Not done: template injection in remote composite steps.
  • transitive pin checks (poutine unpinnable_action);
  • finding node20 actions;
  • template injection in remote composite steps.
• Pinning comments: (feat(unpinned-uses): name the most specific version tag in the comment of --online --fix #224, feat(ref-version-mismatch): fix the version comment (unsafe) and read ratchet comments #227, feat(missing-version-comment): report a hash pin without a version comment and add it with --online --fix #232)
  • The pin fix should write the most specific tag (# v4.2.4, not # v4), like zizmor 1.26 and pinact.
  • Add a fix for ref-version-mismatch that rewrites the comment (unsafe).
  • Report a SHA pin with no comment (pedantic), and add the comment with --online --fix.
• A release cooldown for actions: report a pinned tag younger than N days (pinact --min-age). (feat(action-release-cooldown): report an action at a version younger than N days (online, opt-in) #235)
• Pin container:, services: and docker:// images to a digest through the registry API (ghalint#1044). (feat(unpinned-images): pin container images to a digest with --online --fix=unsafe #239)
• Later: (feat(online): report the jobs whose environment has no required reviewers #247, feat(repojacking): report an action whose owner name anyone can register #248, feat(online): look up the actions of a GitHub Enterprise Server on github.com #250, feat(unpinned-uses): accept the tag of an immutable release under --online #251)
  • check that an environment: gate really has required reviewers (gato-x)
  • repojacking (octoscan)
  • a github.com fallback on GHES (zizmor#735)
  • accept tags of immutable releases (codeql#22674)

6. CLI and integration

• A JSON Schema for .github/jactionlint.yaml, generated from the rule registry, published to SchemaStore and referenced with a $schema header by --init-config. Another for --format json. (feat(config): JSON Schemas for the config file and for --format json #195) The SchemaStore submission is left to a person (steps in scripts/generate-config-schema/README.md).
• Say when shellcheck or pyflakes did not run (actionlint#189, 9 👍). (feat(external-tools): say when shellcheck or pyflakes did not run #188)
  • Exit 3 when an explicit path is missing.
  • Add a coverage note to SARIF.
• Read a shellcheckrc and extra arguments from the config. --norc is hard-coded today (actionlint#755, #486). (feat(shellcheck): read a shellcheckrc, extra arguments and optional checks from the config #191)
• Built-in label prefixes for hosted-runner providers: Blacksmith, Depot, Ubicloud, WarpBuild, BuildJet, Namespace and RunsOn (repro; actionlint#499). (feat(runner-label): accept the labels of hosted-runner providers #199)
• A pre-commit hook with shellcheck bundled (actionlint#477, 10 👍). (fix(pre-commit): run the hooks for action.yml and dependabot.yml, add a bundled-shellcheck hook #181)
• Later: Done: shell completions (feat(cli): add shell completions and --explain RULE #204), --select and --no-ignores (feat(cli): add the options select, no-ignores and list-rules #200), --ruff and Jujutsu workspaces (feat(cli): add --ruff, --show-doc-urls, --finding-context, platform forgejo and jujutsu roots #215). Left open: --lsp and linting .pre-commit-config.yaml (out of scope by decision) and auditing a remote owner/repo@ref directly.
  • --lsp, with fixes as code actions
  • shell completions
  • --select and --no-ignores
  • auditing a remote owner/repo@ref directly
  • linting .pre-commit-config.yaml
  • --ruff
  • Jujutsu workspaces (actionlint#752)

Suggested order

1. Section 1, starting with the Generate workflow and the -latest labels, which have to be done before 2026-10-19. Then the conformance test.
2. Section 2: the checkout protection, Node 20, macos-14 before 2026-11-02, and actions.lock.
3. The untrusted-checkout items of section 3, where other tools are ahead.
4. The quick checks of section 4.
5. Last, remote action metadata, the config JSON Schema and --lsp.

For new checks, follow CONTRIBUTING.md: stable IDs, a documented tier and profile, positive and negative fixtures, and findings reviewed on real repositories. Keep noisy checks in the pedantic profile until there is evidence that they are precise.

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5-5; version: claude-code_2-1-289_agent.