Run actionlint in an isolated Docker container to securely lint workflow files.

This action securely runs actionlint in a Docker container to lint GitHub Actions workflow files. It automatically checks all YAML files in the .github/workflows directory.

This action reduces security risks associated with software supply chain attacks, such as compromised third-party tools or tampered container images. To achieve this, it enforces strict container isolation, disables network connections, and drops unnecessary privileges.

  steps:
    - name: Secure actionlint
      uses: tmknom/secure-actionlint-action@23ef4b1bfd498bb9fadbfeab1d881c565f6ee36f # v0.3.1

  steps:
    - name: Secure actionlint
      uses: tmknom/secure-actionlint-action@23ef4b1bfd498bb9fadbfeab1d881c565f6ee36f # v0.3.1
      with:
        configuration-path: actionlint.yml
        ignore: |-
          "jobs" section is missing in workflow
          "on" section is missing .+

N/A

N/A

actionlint is a linter for GitHub Actions workflow files. It detects errors, security issues, and best practice violations, helping you maintain safer and more reliable workflows.

Running third-party tools directly in your environment may expose your repository and credentials to compromised or malicious code. This action significantly reduces such risks by strictly isolating the environment:

• Network access is completely disabled (--network none)
• All unnecessary Linux capabilities are dropped (--cap-drop all)
• Privilege escalation is explicitly disabled (--security-opt no-new-privileges)
• The action runs as a non-root, restricted user (--user guest)
• The filesystem is strictly read-only (--read-only)
• The repository directory is mounted as read-only (--volume "${PWD}:${PWD}:ro")

This action specifically prevents threats related to software supply chain security (attacks targeting third-party software or tools used in workflows), such as:

• Unauthorized outbound connections from runners, significantly reducing the risk of data leakage
• Malicious updates or compromised tools exploiting elevated privileges or unrestricted network access

This action explicitly specifies the Docker image using its digest (SHA256). Using a digest ensures that exactly the intended and verified image is used every time, eliminating the risk of malicious updates or image tampering.

No. Network connections are completely disabled within the container. Even if the tool were compromised or contained malicious code, disabling network access effectively prevents communication with external attackers, significantly reducing the risk of data leaks.

No. The action runs as a non-root, restricted user without privilege escalation.

Yes, strongly recommended.

To further protect your workflows from unintended or malicious modifications, it's a best practice to pin the action to a specific commit SHA (commit hash). Doing so ensures the immutability of both the action’s code and any resources it references, such as Docker images, further reducing the risk of software supply chain attacks.

Recommended (more secure):

- uses: tmknom/secure-actionlint-action@23ef4b1bfd498bb9fadbfeab1d881c565f6ee36f # v0.3.1

Not recommended:

- uses: tmknom/secure-actionlint-action@v0

Yes. You can customize actionlint parameters through the inputs described in the Inputs section. See Custom Usage for an example.

For more details on configuring actionlint, refer to the official documentation:

• configuration-path input: Configuration of actionlint
• ignore input: All checks done by actionlint

This action intentionally limits arbitrary customization to ensure secure, isolated, and predictable execution. If you require further customization, consider creating your own fork of this action.

No. The impact is minimal, primarily due to the overhead of pulling and executing a small Docker container. Typically, this added overhead is negligible, and the security improvements provided by the action justify its use.

No. This action strictly requires Docker to be installed on your GitHub Actions runner. Without Docker, the action will fail to execute, as it relies on Docker’s isolation mechanisms to run securely.

N/A

See GitHub Releases.