ci: add actionlint

[kolyshkin]

No description provided.

[thaJeztah]

Wondering how this one compares to Zimor (which has proven to be very good overall);

https://github.com/zizmorcore/zizmor
https://github.com/zizmorcore/zizmor-action

cc @crazy-max

[kolyshkin]

Wondering how this one compares to Zimor (which has proven to be very good overall);

https://github.com/zizmorcore/zizmor https://github.com/zizmorcore/zizmor-action

cc @crazy-max

IMHO actionlint is more about correctness, while zizmor is more about security. Perhaps we can use both?

[kolyshkin]

Alas actionlint is a bit abandoned with no commits since mid-April, and it lacks last versions of standard actions (and thus it doesn't flag some issues). Opened rhysd/actionlint#718 as a fix.

[thaJeztah]

IMHO actionlint is more about correctness, while zizmor is more about security. Perhaps we can use both?

Maybe, yes. I'm honestly not that familiar with actionlint. We should look where they overlap, and where gaps are (ISTR zizmor also had various checks for correctness, so maybe already covers a bunch).

[kolyshkin]

IMHO actionlint is more about correctness, while zizmor is more about security. Perhaps we can use both?

Maybe, yes. I'm honestly not that familiar with actionlint. We should look where they overlap, and where gaps are (ISTR zizmor also had various checks for correctness, so maybe already covers a bunch).

I ran a quick test (with the help of AI): actionlint caught 6 of 7 issues, zizmor only found 1 of 7. NOTE this test is deliberately biased towards broken workflows (rather than their security).

Here's the file:

  name: broken
  on:
    pull_request:
  permissions:
    contents: read
  jobs:
    j:
      runs-on: ubuntu-24.04
      steps:
        - uses: actions/checkout@v7
        - run: echo ${{ github.event.pull_request.title }} # 1
        - run: echo "${{ matrix.nosuch }}" # 2
        - if: github.event_name == 'pull_request' && sucess() # 3
          run: |
            FILES=$(ls)
            echo $FILES # 4
        - uses: actions/setup-go@v7
          with:
            go-versionn: '1.24' # 5
    k:
      needs: nonexistent # 6
      runs-on: ubunut-24.04 # 7
      steps:
        - run: true

Issues:

1. untrusted github.event.pull_request.title interpolated into run
2. matrix.nosuch -- no strategy.matrix on this job
3. sucess() typo -- undefined function
4. shellcheck SC2086 unquoted $FILES
5. typo in action parameter (go-versionn).
6. needs: nonexistent (refers to a missing job)
7. ubunut-24.04 -- typo

Zizmor only found 1 ("template-injection").

actionlint found all but 5 (and this is being fixed in rhysd/actionlint#718).

I am not against adding zizmor (and will probably do so later), but it serves a very different purpose to that of actionlint.

[kolyshkin]

I am not against adding zizmor (and will probably do so later)

Done: #5387

[kolyshkin]

Again, zizmor and actionlint serve entirely different purposes:

• actionlint is to check GHA validity (and help with any possible issues, for example when a CI job is not being run);
• zizmor is security-focused and helps to prevent various bad things.

[cyphar]

I was working on adding actionlint and zizmor to libpathrs and I also found that they have totally different uses and having both is useful -- it is really nice when actionlint finds a typo in a variable substitution without you need to do a full CI run to find it.

[cyphar]

There isn't an action we can pin against? If we do it this way dependabot won't be able to bump this for us (FWIW renovate has mechanisms to allow for custom bump rules that would work here but we decided to not switch last time we discussed this IIRC).

[kolyshkin]

There's a third party action which we can use. Internally it runs a docker image and has a few small issues () but I guess the luxury of being updated by dependabot outweighs the flaws.

Changed to use https://github.com/devops-actions/actionlint

[kolyshkin]

For the reference, the "few small issues" with actionlint action are:

• Drop the unneeded pull-requests: write permission devops-actions/actionlint#210
• Fix file path parsing for consecutive actionlint errors devops-actions/actionlint#211
• Fix shell issues in the action script devops-actions/actionlint#212

[kolyshkin]

(those do not prevent from using the action as is, IOW we don't have to wait for a new version with those PRs applied)

[kolyshkin]

@opencontainers/runc-maintainers PTAL (easy to review, CI only, and I have another PR which depending on this one)