v1.5.0

• action rule now validates inputs of popular actions at with:. When a required input is not specified or an undefined input is specified, actionlint will report it.
  • Popular actions are updated automatically once a week and the data set is embedded to executable directly. The check does not need any network request and does not affect performance of actionlint. Sources of the actions are listed here. If you have some request to support new action, please report it at the issue form.
  • Please see the document for example (Playground).
• expression rule now types outputs of popular actions (type of steps.{id}.outputs object) more strictly.
  • For example, actions/cache@v2 sets cache-hit output. The outputs object is typed as { cache-hit: any }. Previously it was typed as any which means no further type check was performed.
  • Please see the second example of the document (Playground).
• Outputs of local actions (their names start with ./) are also typed more strictly as well as popular actions.
• Metadata (action.yml) of local actions are now cached to avoid reading and parsing action.yml files repeatedly for the same action.
• Add new rule permissions to check permission scopes for default secrets.GITHUB_TOKEN. Please see the document for more details (Playground).
• Structure of actionlint.Permissions struct was changed. A parser no longer checks values of permissions: configuration. The check is now done by permissions rule.