starred/act

Fork 0

mirror of https://github.com/nektos/act.git synced 2026-04-26 09:25:54 +03:00

actionlint from 1.6.27 to 1.7.0 #2394

New issue

Closed

opened 2026-03-01 21:55:15 +03:00 by kerem · 0 comments

kerem commented

2026-03-01 21:55:15 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/nektos/act/pull/2326
Author: @dependabot[bot]
Created: 5/13/2024
Status: ✅ Merged
Merged: 5/13/2024
Merged by: @mergify[bot]

Base: master ← Head: dependabot/go_modules/github.com/rhysd/actionlint-1.7.0

📝 Commits (2)

e8653b0 build(deps): bump github.com/rhysd/actionlint from 1.6.27 to 1.7.0
0ffdc10 Merge branch 'master' into dependabot/go_modules/github.com/rhysd/actionlint-1.7.0

📊 Changes

2 files changed (+6 additions, -6 deletions)

View changed files

📝 go.mod (+2 -2)
📝 go.sum (+4 -4)

📄 Description

Bumps github.com/rhysd/actionlint from 1.6.27 to 1.7.0.

Release notes

Sourced from github.com/rhysd/actionlint's releases.

v1.7.0
From this version, actionlint starts to check action metadata file action.yml (or action.yaml). At this point, only very basic checks are implemented and contents of steps: are not checked yet.
It checks properties under runs: section (e.g. main: can be specified when it is a JavaScript action), branding: properties, and so on.
name: 'My action'
author: '...'
# ERROR: 'description' section is missing
branding:
ERROR: Invalid icon name
icon: dog
runs:
ERROR: Node.js runtime version is too old
using: 'node12'
ERROR: The source file being run by this action does not exist
main: 'this-file-does-not-exist.js'
ERROR: 'env' configuration is only allowed for Docker actions
env:
SOME_VAR: SOME_VALUE
actionlint still focuses on checking workflow files. So there is no way to directly specify action.yml as an argument of actionlint command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead.

Checks for steps: contents are planned to be implemented. Since several differences are expected between steps: in workflow file and steps: in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected.
Add runner.environment property. (#412)
- run: echo 'Run by GitHub-hosted runner'
  if: runner.environment == 'github-hosted'
Using outdated popular actions is now detected at error. See the document for more details.
Here 'outdated' means actions which use runtimes no longer supported by GitHub-hosted runners such as node12.
# ERROR: actions/checkout@v2 is using the outdated runner 'node12'
- uses: actions/checkout@v2
Support attestations permission which was recently added to GitHub Actions as beta. (#418, thanks @bdehamer)
permissions:
  id-token: write
  contents: read
  attestations: write
Check comparison expressions more strictly. Arbitrary types of operands can be compared as the official document explains. However, comparisons between some types are actually meaningless because the values are converted to numbers implicitly. actionlint catches such meaningless comparisons as errors. Please see the check document for more details.
on:
  workflow_call:
    inputs:
      timeout:
        type: boolean
jobs:

... (truncated)

Changelog

Sourced from github.com/rhysd/actionlint's changelog.

v1.7.0 - 08 May 2024
From this version, actionlint starts to check action metadata file action.yml (or action.yaml). At this point, only very basic checks are implemented and contents of steps: are not checked yet.
It checks properties under runs: section (e.g. main: can be specified when it is a JavaScript action), branding: properties, and so on.
name: 'My action'
author: '...'
# ERROR: 'description' section is missing
branding:
ERROR: Invalid icon name
icon: dog
runs:
ERROR: Node.js runtime version is too old
using: 'node12'
ERROR: The source file being run by this action does not exist
main: 'this-file-does-not-exist.js'
ERROR: 'env' configuration is only allowed for Docker actions
env:
SOME_VAR: SOME_VALUE
actionlint still focuses on checking workflow files. So there is no way to directly specify action.yml as an argument of actionlint command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead.

Checks for steps: contents are planned to be implemented. Since several differences are expected between steps: in workflow file and steps: in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected.
Add runner.environment property. (#412)
- run: echo 'Run by GitHub-hosted runner'
  if: runner.environment == 'github-hosted'
Using outdated popular actions is now detected at error. See the document for more details.
Here 'outdated' means actions which use runtimes no longer supported by GitHub-hosted runners such as node12.
# ERROR: actions/checkout@v2 is using the outdated runner 'node12'
- uses: actions/checkout@v2
Support attestations permission which was recently added to GitHub Actions as beta. (#418, thanks @bdehamer)
permissions:
  id-token: write
  contents: read
  attestations: write
Check comparison expressions more strictly. Arbitrary types of operands can be compared as the official document explains. However, comparisons between some types are actually meaningless because the values are converted to numbers implicitly. actionlint catches such meaningless comparisons as errors. Please see the check document for more details.
on:
  workflow_call:
    inputs:
      timeout:
        type: boolean

... (truncated)

Commits

f970a14 bump up version to v1.7.0
664e100 move dependencies for testing to dev-dependencies in playground
3b1ec3b update golang.org/x/sys to v0.20
04afd4f add golangci/golangci-lint-action@v6 to popular actions data set
2ac37c7 add workaround for dorny/paths-filter@v3's predicate-quantifier input (#416)
d8e9b53 add octokit/graphql-action@v2.x to popular actions data set
b3c4e99 add actions/add-to-project@v1.0.1 to popular actions data set
4b9b046 Merge branch 'strict-compare'
1901992 add workflow tests for comparison checks
489bf77 add unit tests for comparisons type check
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/nektos/act/pull/2326 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 5/13/2024 **Status:** ✅ Merged **Merged:** 5/13/2024 **Merged by:** [@mergify[bot]](https://github.com/apps/mergify) **Base:** `master` ← **Head:** `dependabot/go_modules/github.com/rhysd/actionlint-1.7.0` --- ### 📝 Commits (2) - [`e8653b0`](https://github.com/nektos/act/commit/e8653b0c9becf7e7501edd6412e6dadbbd7696f8) build(deps): bump github.com/rhysd/actionlint from 1.6.27 to 1.7.0 - [`0ffdc10`](https://github.com/nektos/act/commit/0ffdc102b1670254af503350c8851ded2f14c4f7) Merge branch 'master' into dependabot/go_modules/github.com/rhysd/actionlint-1.7.0 ### 📊 Changes **2 files changed** (+6 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `go.mod` (+2 -2) 📝 `go.sum` (+4 -4) </details> ### 📄 Description Bumps [github.com/rhysd/actionlint](https://github.com/rhysd/actionlint) from 1.6.27 to 1.7.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rhysd/actionlint/releases">github.com/rhysd/actionlint's releases</a>.</em></p> <blockquote> <h2>v1.7.0</h2> <ul> <li>From this version, actionlint starts to check action metadata file <code>action.yml</code> (or <code>action.yaml</code>). At this point, only very basic checks are implemented and contents of <code>steps:</code> are not checked yet. <ul> <li>It checks properties under <code>runs:</code> section (e.g. <code>main:</code> can be specified when it is a JavaScript action), <code>branding:</code> properties, and so on. <pre lang="yaml"><code>name: 'My action' author: '...' # ERROR: 'description' section is missing <p>branding:</p> <h1>ERROR: Invalid icon name</h1> <p>icon: dog</p> <p>runs:</p> <h1>ERROR: Node.js runtime version is too old</h1> <p>using: 'node12'</p> <h1>ERROR: The source file being run by this action does not exist</h1> <p>main: 'this-file-does-not-exist.js'</p> <h1>ERROR: 'env' configuration is only allowed for Docker actions</h1> <p>env: SOME_VAR: SOME_VALUE </code></pre></p> </li> <li>actionlint still focuses on checking workflow files. So there is no way to directly specify <code>action.yml</code> as an argument of <code>actionlint</code> command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead.</li> <li>Checks for <code>steps:</code> contents are planned to be implemented. Since several differences are expected between <code>steps:</code> in workflow file and <code>steps:</code> in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected.</li> </ul> </li> <li>Add <code>runner.environment</code> property. (<a href="https://redirect.github.com/rhysd/actionlint/issues/412">#412</a>) <pre lang="yaml"><code>- run: echo 'Run by GitHub-hosted runner' if: runner.environment == 'github-hosted' </code></pre> </li> <li>Using outdated popular actions is now detected at error. See <a href="https://github.com/rhysd/actionlint/blob/main/docs/checks.md#detect-outdated-popular-actions">the document</a> for more details. <ul> <li>Here 'outdated' means actions which use runtimes no longer supported by GitHub-hosted runners such as <code>node12</code>. <pre lang="yaml"><code># ERROR: actions/checkout@v2 is using the outdated runner 'node12' - uses: actions/checkout@v2 </code></pre> </li> </ul> </li> <li>Support <code>attestations</code> permission which was <a href="https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds">recently added to GitHub Actions as beta</a>. (<a href="https://redirect.github.com/rhysd/actionlint/issues/418">#418</a>, thanks <a href="https://github.com/bdehamer"><code>@bdehamer</code></a>) <pre lang="yaml"><code>permissions: id-token: write contents: read attestations: write </code></pre> </li> <li>Check comparison expressions more strictly. Arbitrary types of operands can be compared as <a href="https://docs.github.com/en/actions/learn-github-actions/expressions#operators">the official document</a> explains. However, comparisons between some types are actually meaningless because the values are converted to numbers implicitly. actionlint catches such meaningless comparisons as errors. Please see <a href="https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-comparison-types">the check document</a> for more details. <pre lang="yaml"><code>on: workflow_call: inputs: timeout: type: boolean <p>jobs: </code></pre></p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md">github.com/rhysd/actionlint's changelog</a>.</em></p> <blockquote> <h1><a href="https://github.com/rhysd/actionlint/releases/tag/v1.7.0">v1.7.0</a> - 08 May 2024</h1> <ul> <li>From this version, actionlint starts to check action metadata file <code>action.yml</code> (or <code>action.yaml</code>). At this point, only very basic checks are implemented and contents of <code>steps:</code> are not checked yet. <ul> <li>It checks properties under <code>runs:</code> section (e.g. <code>main:</code> can be specified when it is a JavaScript action), <code>branding:</code> properties, and so on. <pre lang="yaml"><code>name: 'My action' author: '...' # ERROR: 'description' section is missing <p>branding:</p> <h1>ERROR: Invalid icon name</h1> <p>icon: dog</p> <p>runs:</p> <h1>ERROR: Node.js runtime version is too old</h1> <p>using: 'node12'</p> <h1>ERROR: The source file being run by this action does not exist</h1> <p>main: 'this-file-does-not-exist.js'</p> <h1>ERROR: 'env' configuration is only allowed for Docker actions</h1> <p>env: SOME_VAR: SOME_VALUE </code></pre></p> </li> <li>actionlint still focuses on checking workflow files. So there is no way to directly specify <code>action.yml</code> as an argument of <code>actionlint</code> command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead.</li> <li>Checks for <code>steps:</code> contents are planned to be implemented. Since several differences are expected between <code>steps:</code> in workflow file and <code>steps:</code> in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected.</li> </ul> </li> <li>Add <code>runner.environment</code> property. (<a href="https://redirect.github.com/rhysd/actionlint/issues/412">#412</a>) <pre lang="yaml"><code>- run: echo 'Run by GitHub-hosted runner' if: runner.environment == 'github-hosted' </code></pre> </li> <li>Using outdated popular actions is now detected at error. See <a href="https://github.com/rhysd/actionlint/blob/main/docs/checks.md#detect-outdated-popular-actions">the document</a> for more details. <ul> <li>Here 'outdated' means actions which use runtimes no longer supported by GitHub-hosted runners such as <code>node12</code>. <pre lang="yaml"><code># ERROR: actions/checkout@v2 is using the outdated runner 'node12' - uses: actions/checkout@v2 </code></pre> </li> </ul> </li> <li>Support <code>attestations</code> permission which was <a href="https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds">recently added to GitHub Actions as beta</a>. (<a href="https://redirect.github.com/rhysd/actionlint/issues/418">#418</a>, thanks <a href="https://github.com/bdehamer"><code>@bdehamer</code></a>) <pre lang="yaml"><code>permissions: id-token: write contents: read attestations: write </code></pre> </li> <li>Check comparison expressions more strictly. Arbitrary types of operands can be compared as <a href="https://docs.github.com/en/actions/learn-github-actions/expressions#operators">the official document</a> explains. However, comparisons between some types are actually meaningless because the values are converted to numbers implicitly. actionlint catches such meaningless comparisons as errors. Please see <a href="https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-comparison-types">the check document</a> for more details. <pre lang="yaml"><code>on: workflow_call: inputs: timeout: type: boolean <p></code></pre></p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rhysd/actionlint/commit/f970a14472c1b4d576f8456884a3238aa353a288"><code>f970a14</code></a> bump up version to v1.7.0</li> <li><a href="https://github.com/rhysd/actionlint/commit/664e100a512cddc3638aea6b5f811c3cb90a2cff"><code>664e100</code></a> move dependencies for testing to dev-dependencies in playground</li> <li><a href="https://github.com/rhysd/actionlint/commit/3b1ec3be6e6fff52b1e82dd5b9689ee5c2ff8f67"><code>3b1ec3b</code></a> update <code>golang.org/x/sys</code> to v0.20</li> <li><a href="https://github.com/rhysd/actionlint/commit/04afd4fd2f4fdaaf40049242bed4338784cffee6"><code>04afd4f</code></a> add <code>golangci/golangci-lint-action@v6</code> to popular actions data set</li> <li><a href="https://github.com/rhysd/actionlint/commit/2ac37c776223210fd9301022443584acb063f26d"><code>2ac37c7</code></a> add workaround for <code>dorny/paths-filter@v3</code>'s <code>predicate-quantifier</code> input (<a href="https://redirect.github.com/rhysd/actionlint/issues/416">#416</a>)</li> <li><a href="https://github.com/rhysd/actionlint/commit/d8e9b53e56772b79b28e3e788e47fcfc099d4137"><code>d8e9b53</code></a> add <code>octokit/graphql-action@v2.x</code> to popular actions data set</li> <li><a href="https://github.com/rhysd/actionlint/commit/b3c4e998039c18fd18823a761d261543b3f9ad0e"><code>b3c4e99</code></a> add <code>actions/add-to-project@v1.0.1</code> to popular actions data set</li> <li><a href="https://github.com/rhysd/actionlint/commit/4b9b04624d53e56bcebe809f2a7f90e9ad2800a7"><code>4b9b046</code></a> Merge branch 'strict-compare'</li> <li><a href="https://github.com/rhysd/actionlint/commit/1901992f0234280bc7e66797cc589d83352b73eb"><code>1901992</code></a> add workflow tests for comparison checks</li> <li><a href="https://github.com/rhysd/actionlint/commit/489bf77d7eaf72e586d9c2cf6308c24f79a8c740"><code>489bf77</code></a> add unit tests for comparisons type check</li> <li>Additional commits viewable in <a href="https://github.com/rhysd/actionlint/compare/v1.6.27...v1.7.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/rhysd/actionlint&package-manager=go_modules&previous-version=1.6.27&new-version=1.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem

2026-03-01 21:55:15 +03:00

closed this issue
added the
pull-request
label

kerem referenced this issue

2026-03-01 21:55:23 +03:00

[PR #2394] [MERGED] Fix #2363. Add /pre- and /post-entrypoint handling #2423

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/act#2394

No description provided.

Rows
Columns