Actionlint Processor

Purpose

Lints GitHub Actions workflow files using actionlint.

The Rust alternative is iactionlint: the same rules, the same .github/actionlint.yaml, the same messages, in-process. Switching is actionlint → iactionlint in the stanza header. It does not run shellcheck or pyflakes over run: scripts; a repository that relies on that stays here.

How It Works

Discovers .yml/.yaml files in the configured directories, runs actionlint on each file, and records success in the cache. A non-zero exit code from actionlint fails the product.

actionlint validates workflow syntax against the GitHub Actions schema, type-checks ${{ }} expressions, checks runs-on labels and cron syntax, flags untrusted-input injection in run: steps, and (when shellcheck is installed) lints the shell scripts inside run: blocks.

actionlint reads its own configuration from .github/actionlint.yaml (or .yml) in the repository — e.g. a self-hosted-runner.labels allowlist for runner labels its built-in database doesn’t know. Both paths are tracked via dep_auto, so editing the config retriggers the check.

This processor supports batch mode.

Source Files

• Input: **/*.yml, **/*.yaml (point src_dirs at .github/workflows)
• Output: none (checker)

Configuration

[processor.checker.actionlint]
src_dirs = [".github/workflows"]
args = []
dep_inputs = []

Scoping src_dirs to .github/workflows matters: actionlint treats every file it is given as a workflow file, so pointing it at a directory of ordinary YAML would report false errors.

Batch support

The tool accepts multiple files on the command line. When batching is enabled (default), rsconstruct passes all files in a single invocation for better performance.

Clean behavior

This processor is a Checker — rsconstruct clean outputs is a no-op for it (checkers produce no outputs). See Clean behavior and rsconstruct clean.