fix(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
anolilab/workflows	action	patch	v24.2.0 → v24.2.2
github/codeql-action	action	minor	v4.38.3 → v4.39.0
jdx/jactionlint	action	minor	v2.1.0 → v2.2.0

---

Release Notes

anolilab/workflows

v24.2.2

Compare Source

Bug Fixes

• deps: update github-actions (60d172d)
• deps: update patch updates (97765e1)

Miscellaneous Chores

• deps: merge renovate branch github-actions (32cd02a)
• deps: merge renovate branch patch-patch-updates (37f2033)

v24.2.1

Compare Source

Bug Fixes

• deps: update dependency prettier to ^3.9.10 (#​544) (42c2468)

github/codeql-action

v4.39.0

Compare Source

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

jdx/jactionlint

v2.2.0: : New rules, repository-aware CLI modes, and a PyPI package

Compare Source

jactionlint 2.2.0 adds about thirty new rules and extends many existing ones, mostly for script injection, token permissions, pinning and runner limits. It also adds CLI modes for pull request checks (--changed-since), rule discovery (--list-rules, --explain, shell completions), fact export and timeout suggestions, and publishes wheels to PyPI. Several new rules are in the default or correctness profile, so a run that was clean on 2.1.0 can show new findings. See Changed before you upgrade.

Highlights

• More checks before a run fails: shell syntax errors without shellcheck, JavaScript syntax errors in actions/github-script, job permissions too narrow for the actions in the job, gh without a token, ubuntu-slim limits, github.event property typos, and validation of GitHub's Actions lock file.
• Deeper security analysis: untrusted-checkout, cache-poisoning, template-injection and the secret rules follow more code paths. New pedantic and online rules cover command and argument injection, repojacking, release age, unpinned action dependencies and environments without required reviewers.
• Better for CI and tooling: report only findings on changed lines, select single rules, export the repository model as JSON, get JSON Schemas for config and output, and install with pip/uvx.

Added

New rules in the default and correctness profiles

• shell-syntax (default, error): reports syntax errors in bash/sh run: scripts, such as an unclosed quote or a missing fi/done, using a built-in parser. It runs only when shellcheck does not run, so the two never report the same error. (#​273, @​jdx)
• insufficient-permissions (default, error): reports a job whose explicit permissions: miss a scope that one of its actions needs (upload-sarif, deploy-pages, OIDC logins, gh release create, git push and others, about 26 entries). missing-permissions --fix now uses the same table to write job-level permissions when the needs are exact. (#​192, @​jdx)
• ubuntu-slim-limits (default, error): reports container:, services: and Docker container actions in jobs that run only on ubuntu-slim. With pedantic, it also reports timeout-minutes above 15. missing-timeout --fix limits its value to 15 for these jobs. (#​190, @​jdx)
• actions-lock (default, error) and actions-lock-drift (online): check .github/workflows/actions.lock against the workflows. They report missing, stale and malformed entries. With --online, they also report replaced repositories, moved tags and commits that are on no branch or tag. Repositories without a lock file are not affected. unpinned-uses accepts a ref that the lock file pins to a commit. (#​237, #​228, @​jdx)
• hardcoded-registry-credentials (default, error): reports plain-text passwords, tokens and keys in registries of dependabot.yml, including passwords embedded in a registry URL. (#​265, @​jdx)
• gh-without-token (correctness): reports a gh command that needs a token in a step where no GH_TOKEN/GITHUB_TOKEN is set. (#​177, @​jdx)
• environment-file-redirect (correctness): reports writes to GITHUB_OUTPUT (and similar files) without the $, and a > that overwrites data the same script already wrote. It has a fix: safe for the missing $, unsafe for >. (#​184, @​jdx)
• github-script-syntax (correctness): checks the script input of actions/github-script with node --check. It knows the argument names of each action version, so it catches errors like const glob = require(...). It needs Node.js 20 or later on PATH; without it, the rule is skipped and a note says so. (#​242, @​jdx)
• malformed-expression-delimiters (correctness): reports ${ github.ref }, $ {{ x }} and {{ github.sha }}. (#​180, @​jdx)
• multiline-plain-run (correctness): reports a multi-line run: that YAML folds into a single line. (#​205, #​256, @​jdx)
• concurrency-deadlock (correctness): reports a concurrency group that a workflow shares with a local reusable workflow it calls. GitHub cancels such runs as a deadlock. (#​210, @​jdx)
• conflicting-action-inputs (correctness), plus new missing-action-input cases: report input combinations of well-known actions that cannot work, for example download-artifact name with artifact-ids, or nick-fields/retry without exactly one timeout input. (#​207, @​jdx)
• undefined-property now checks github.event.* property names against the webhook payloads, down to three levels. By default, it reports only names that no event has. The strict-event-payloads option, on in the pedantic profile, also reports properties that the workflow's own triggers don't have. (#​249, @​jdx)

New pedantic rules

• deprecated-runner-label: warns about runner labels with an announced retirement date (macos-14, ubuntu-22.04), with replacement labels. (#​182)
• deprecated-node-runtime: reports runs.using: node20/16/12 in action metadata, popular actions at majors that declare node20, and environment variables that select the Node.js runtime. (#​225, #​230, #​234)
• command-injection: reports untrusted input that was moved to env: but then runs as code (eval, bash -c, python -c, execSync in github-script, and similar). (#​202)
• argument-injection: reports free text in the program of sed/awk, in find -exec, or as a leading word of tar, curl, git clone and others. (#​221)
• output-clobbering: reports input that can contain line breaks written to GITHUB_OUTPUT as a single record. (#​212)
• comment-trigger-authorization: reports comment-triggered jobs that don't check who commented. (#​217)
• event-name-never-received: reports github.event_name compared with an event the workflow never receives. (#​214)
• fail-fast-action-inputs: reports actions configured to pass when they produced nothing. (#​196)
• macos-gnu-flags: reports GNU-only options in run scripts of macOS jobs. (#​241)
• unmatched-paths-filter: reports paths filters that match no file in the repository. (#​238)
• missing-version-comment: reports a commit-SHA pin without a version comment. --online --fix adds the comment. (#​232)
• unused-workflow-secret: reports on.workflow_call.secrets that nothing reads. (#​223)

All by @​jdx.

New online rules

• repojacking: reports an action or reusable workflow whose owner name anyone could register. It runs on github.com only. (#​248, @​jdx)
• unpinnable-action: reports an action pinned by hash whose own dependencies are not pinned. (#​240, @​jdx)
• action-release-cooldown (opt-in): reports an action at a version released less than N days ago. It is off until the config has an entry for it:

  rules:
    action-release-cooldown: { level: warning, days: 7 }

  (#​235, @​jdx)

Extensions to existing rules

• untrusted-checkout follows the pull request revision through variables, script files, pull/N/head fetches, local reusable workflows and composite actions. It now covers issue_comment workflows that build a pull request, and reports gates that pass once in front of code that can change. It honors the fork protection of actions/checkout, and counts actions that run the workspace and the input that makes them do it. (#​159, #​175, #​203, #​206, #​208, #​213, #​220, @​jdx)

• With --online, environments are checked: untrusted-checkout, untrusted-artifact and agentic-actions no longer trust an environment: that has no required reviewers, or that doesn't exist in a public repository. (#​247, @​jdx)

• cache-poisoning:

  • A build job that uploads artifacts for a publishing job counts as a release job, even with a read-only token.
  • More publishers are recognized, including docker/build-push-action with an expression for push, plus maturin and sccache caches, pnpm/setup, graalvm and composer.
  • Caches of credential files are reported.
  • A new pedantic option adds zizmor's heuristics for tag-triggered and release-branch workflows.

  (#​160, #​216, @​jdx)

• template-injection reports more outsider-controlled free text in the default profile: previous titles and bodies of edited issues, the fork homepage, wiki page titles, merge queue commit messages, and workflow_run paths. (#​173, @​jdx)

• dangerous-triggers messages say which token scopes the workflow can write and which secrets it reads. (#​189, @​jdx)

• github-env follows text that a script reads with gh and git. (#​218, @​jdx)

• unpinned-images checks docker run images in scripts and adds per-image policies and image allow/deny lists. --online --fix=unsafe pins container images to a digest. (#​211, #​239, @​jdx)

• unpinned-uses accepts the tag of an immutable release under --online. --online --fix names the most specific version tag in the comment it writes. (#​251, #​224, @​jdx)

• ref-version-mismatch reads ratchet comments and can fix the version comment (unsafe). (#​227, @​jdx)

• workflow-secret-scope has a job-level option. secrets-outside-env now reports secrets passed to reusable workflows. (#​223, @​jdx)

• More pedantic options:

  • unlocked-install reports npm/yarn/bun/aube installs that run lifecycle scripts or have no release-age cooldown.
  • untrusted-artifact knows more download actions and reports downloads of every artifact.
  • use-trusted-publishing reports jobs that build, have no environment, or drop attestations.
  • unredacted-secrets reports values cut from a secret and printed by a script.
  • concurrency-limits reports schedule-only and manual-only workflows.

  (#​187, #​201, #​255, #​219, #​209, #​222, #​266, @​jdx)

• aube is recognized wherever npm, pnpm, yarn and bun are. (#​254, @​jdx)

• Runner labels:

  • Labels of Blacksmith, Depot, Namespace, RunsOn, Ubicloud and WarpBuild are accepted. Limit them with self-hosted-runner.providers.
  • Labels built from a matrix value and text are checked.
  • self-hosted-runner counts the configured labels and runner groups, and says when a pull request reaches the runner.

  (#​199, #​233, #​194, @​jdx)

• github-app checks two more token actions, and dependabot-missing-actions-update covers local composite actions. (#​229, @​jdx)

• superfluous-actions resolves runs-on expressions that the repository defines. (#​271, @​jdx)

• missing-timeout has an accept-step-timeouts option for jobs whose steps all set timeout-minutes. (#​252, @​jdx)

Online checks

• With --online, the inputs of any remote action outside the built-in data set are checked against its action.yml at the pinned ref. Calls of reusable workflows in other repositories are checked the same way. (#​231, #​236, @​jdx)
• On GitHub Enterprise Server, actions from github.com can be looked up on github.com. (#​250, @​jdx)
• --online-report=FILE writes online coverage and cache freshness as JSON, for any output format. The SARIF output gets the same fields. (#​166, @​jdx)

CLI and configuration

• --changed-since REV shows only findings on lines changed since the merge base with REV, for pull request checks. --changed-scope files shows every finding in a changed file. The whole repository and call graph are still analyzed. A missing merge base, for example in a shallow clone, exits with status 3. (#​274, #​279, @​jdx)

  jactionlint --changed-since origin/main

• --select=RULES reports only the named rules. --no-ignores disables inline ignores, config ignores and the baseline. --list-rules lists all rules, also as JSON. (#​200, @​jdx)
• --explain RULE prints a rule's documentation, options, fix prerequisites and examples, offline. --completion=bash|zsh|fish|powershell prints a shell completion script. (#​204, #​269, @​jdx)
• --show-fix-status shows under each finding whether a fix is available and how to apply it, and more fixable rules say why a finding has no fix. SARIF output explains a missing fix as well. (#​269, #​164, @​jdx)
• --show-doc-urls and --finding-context (events and token permissions on each JSON/SARIF finding) add details to the output. --ruff=CMD checks Python scripts with ruff instead of pyflakes. The config key platform: forgejo|gitea accepts full-URL uses: references to other hosts. Jujutsu (.jj) workspaces are detected as project roots. (#​215, @​jdx)
• --export-facts prints the events, permissions, concurrency, jobs, steps and calls of a repository as versioned JSON, for jq or policy tools. --print-facts-schema prints its schema. (#​272, @​jdx)
• --suggest-timeouts reports how long each job took in its latest successful runs and suggests a timeout-minutes value. It is a report only and changes no files. (#​275, @​jdx)
• JSON Schemas for the config file and for --format json output are available through --print-config-schema and --print-output-schema. --init-config adds a yaml-language-server schema comment. (#​195, @​jdx)
• A new shellcheck: config section sets rcfile, args and enable. The --shellcheck-rcfile=FILE flag overrides rcfile. (#​191, @​jdx)
• A note says when shellcheck, pyflakes or node did not run. (#​188, @​jdx)

Installation

• Wheels are published to PyPI, so jactionlint can be installed with pip, pipx, uv tool or uvx. (#​277, @​jdx)

  uvx jactionlint

• The pre-commit hooks now also run when action.yml or dependabot.yml changes. A new jactionlint-shellcheck hook builds shellcheck into the hook environment. (#​181, @​jdx)

Changed

• New findings on existing workflows. The new default and correctness rules above, the new template-injection contexts and the wider cache-poisoning coverage can report on workflows that passed on 2.1.0. actions-lock reports only in repositories with an Actions lock file. Popular actions pinned to a full version, or to a commit with a version comment, now get their inputs checked. (#​174, @​jdx)

• Stricter syntax checks. These are now reported because GitHub rejects them: a schedule entry without cron, merge_group types other than checks_requested, $/path@ref, $/ paths that leave the repository or don't exist, timeout-minutes in composite steps, unsupported contexts in action input defaults, and expressions in uses:. (#​186, @​jdx)

• Runner label retirements: unknown-runner-label will start reporting macos-14 on 2026-11-02 and ubuntu-22.04 on 2027-04-17. Each finding names the retirement date and replacement labels. Before those dates, only the pedantic deprecated-runner-label warns. (#​182, @​jdx)

• Fewer default findings:

  • dangerous-triggers reports a workflow that has no write scopes and reads no secrets only with pedantic. (#​189)
  • cache-poisoning reports docker/setup-buildx-action only when version is set. pedantic restores the old behavior. (#​160)
  • Hosted-runner provider labels are no longer unknown. (#​199)

  All by @​jdx.

• A broken extends is now an error. In a discovered config file, an extends entry that points to a missing file exits with status 3. Before, the whole config was silently skipped. (#​285, @​jdx)

• Ignore comments inside scripts no longer apply. An own-line # jactionlint ignore= inside a run: | block or another multi-line string has no effect. Only real YAML comments are read. (#​284, @​jdx)

• Go API:

  • NewLinter(out, nil) no longer panics.
  • Error.PrettyPrint prints the rule ID instead of the kind. Error() is unchanged.
  • ExprSemanticsChecker rejects every context unless SetContextAvailability is called.

  (#​283, @​jdx)

Fixed

• False positives:
  • Keys and values that the workflow schema allows but the docs don't list are accepted. (#​170)
  • A whole mapping or list written as one expression is accepted where the schema allows it. (#​178)
  • if-always-true no longer reports the trailing newlines of a block scalar. (#​226)
• Missing findings:
  • -latest runner labels are matched to the images behind them. (#​171)
  • Permission findings of the pedantic profile are reported again. (#​176)
  • untrusted-checkout skips merged pull requests and counts sed -f, awk -f, tar -P and unzip -:. (#​175)
• --changed-since counts findings that several files share once, keeps ..foo paths inside the repository, and refuses --export-facts. (#​279)
• download-jactionlint.bash: a missing release now prints a clear error instead of a gzip error. The script accepts amd64 (FreeBSD), and its help text is corrected. (#​282)
• --help and messages: --help and several online and --migrate-ignores messages now match the documented behavior. (#​287)

All by @​jdx.

Performance

• Peak memory is lower on very large repositories because fewer workflows are checked at the same time. (#​158)
• Each run script is analyzed once, the callers of an action are parsed once, and parsed expressions are shared between rules. (#​270, #​165)
• The --online checks read the advisories of all actions with one request. (#​268)

All by @​jdx.

Full Changelog: jdx/jactionlint@v2.1.0...v2.2.0

💚 Sponsor jactionlint

jactionlint is a fork of rhysd/actionlint, maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If jactionlint has a place in your development workflow, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep jactionlint fast, free, and independent.

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "after 10:00 before 19:00 every weekday except after 13:00 before 14:00"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1e0793ef-9b6e-42e2-bc78-e1c0e5ae05cc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}