iac.actionlintactionlint
Runs actionlint over GitHub Actions workflows: syntax, expression types, action inputs, script injection, credentials, and (when installed) ShellCheck and pyflakes on run scripts. Read-only; nothing is executed from the target.
- Engine
- Wrapped scanner
- Wraps
actionlint- Targets
- Infrastructure as code
- Areas
- Reliability, Best practices, Security
- Runs
- By default, when the target applies
- Network
- Only the target itself
Run only this auditor
bunx openaudit . --only iac.actionlintWraps actionlint. When it isn't installed, the auditor is skipped with an install hint and the rest of the audit runs.