2025-07-03 16:55:53 +00:00
|
|
|
code.forgejo.org/forgejo/actions-proto v0.5.1 h1:GCJHR/Y/Apk7Yl7CH9qOsKrdf/k0tRVFeVhz1EIZvb4=
|
|
|
|
|
code.forgejo.org/forgejo/actions-proto v0.5.1/go.mod h1:nu8N1HQLsu3c4T/PpYWbqwNBxsZnEOVxqV0mQWtIQvE=
|
2025-01-09 00:02:03 +00:00
|
|
|
connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw=
|
|
|
|
|
connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
|
2025-08-11 07:13:56 +02:00
|
|
|
dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
|
|
|
|
|
dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
|
2025-06-14 14:54:20 +00:00
|
|
|
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
|
|
|
|
|
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
|
2023-08-10 01:45:25 +00:00
|
|
|
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
|
|
|
|
|
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
|
|
|
|
|
github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
|
2022-08-12 14:59:58 +08:00
|
|
|
github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
|
2025-05-14 08:16:27 +00:00
|
|
|
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
|
|
|
|
|
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
|
2025-08-02 23:00:47 +00:00
|
|
|
github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
|
|
|
|
|
github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
|
2023-05-04 18:45:01 +08:00
|
|
|
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
|
2023-08-10 01:45:25 +00:00
|
|
|
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
|
2023-08-10 01:45:25 +00:00
|
|
|
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
|
2025-03-25 07:27:50 +00:00
|
|
|
github.com/avast/retry-go/v4 v4.6.1 h1:VkOLRubHdisGrHnTu89g08aQEWEgRU7LVEop3GbIcMk=
|
|
|
|
|
github.com/avast/retry-go/v4 v4.6.1/go.mod h1:V6oF8njAwxJ5gRo1Q7Cxab24xs5NCWZBeaHHBklR8mA=
|
Update module github.com/rhysd/actionlint to v1.7.7 (#791)
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [github.com/rhysd/actionlint](https://github.com/rhysd/actionlint) | `v1.6.27` -> `v1.7.7` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
### Release Notes
<details>
<summary>rhysd/actionlint (github.com/rhysd/actionlint)</summary>
### [`v1.7.7`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v177---2025-01-19)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.6...v1.7.7)
- Support runner labels for [Linux arm64 hosted runners](https://github.blog/changelog/2025-01-16-linux-arm64-hosted-runners-now-available-for-free-in-public-repositories-public-preview/). ([#​503](https://github.com/rhysd/actionlint/issues/503), [#​504](https://github.com/rhysd/actionlint/issues/504), thanks [@​martincostello](https://github.com/martincostello))
- `ubuntu-24.04-arm`
- `ubuntu-22.04-arm`
- Update Go dependencies to the latest.
- Update the popular actions data set to the latest.
- Add Linux arm64 job to the CI workflow. Now actionlint is tested on the platform. ([#​507](https://github.com/rhysd/actionlint/issues/507), thanks [@​cclauss](https://github.com/cclauss))
\[Changes]\[v1.7.7]
<a id="v1.7.6"></a>
### [`v1.7.6`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v176---2025-01-04)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.5...v1.7.6)
- Using contexts at specific workflow keys is incorrectly reported as not allowed. Affected workflow keys are as follows. ([#​495](https://github.com/rhysd/actionlint/issues/495), [#​497](https://github.com/rhysd/actionlint/issues/497), [#​498](https://github.com/rhysd/actionlint/issues/498), [#​500](https://github.com/rhysd/actionlint/issues/500))
- `jobs.<job_id>.steps.with.args`
- `jobs.<job_id>.steps.with.entrypoint`
- `jobs.<job_id>.services.<service_id>.env`
- Update Go dependencies to the latest.
\[Changes]\[v1.7.6]
<a id="v1.7.5"></a>
### [`v1.7.5`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v175---2024-12-28)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.4...v1.7.5)
- Strictly check available contexts in `${{ }}` placeholders following the ['Context availability' table](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#context-availability) in the official document.
- For example, `jobs.<job_id>.defaults.run.shell` allows `env` context but `shell` workflow keys in other places allow no context.
```yaml
defaults:
run:
```
### ERROR: No context is available here
```
shell: ${{ env.SHELL }}
jobs:
test:
runs-on: ubuntu-latest
defaults:
run:
```
### OK: 'env' context is available here
```
shell: ${{ env.SHELL }}
steps:
- run: echo hello
```
### ERROR: No context is available here
````
shell: ${{ env.SHELL}}
```
````
- Check a string literal passed to `fromJSON()` call. This pattern is [popular](https://github.com/search?q=fromJSON%28%27+lang%3Ayaml\&type=code) to create array or object constants because GitHub Actions does not provide the literal syntax for them. See the [document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#contexts-and-built-in-functions) for more details. ([#​464](https://github.com/rhysd/actionlint/issues/464))
```yaml
jobs:
test:
```
### ERROR: Key 'mac' does not exist in the object returned by the fromJSON()
```
runs-on: ${{ fromJSON('{"win":"windows-latest","linux":"ubuntul-latest"}')['mac'] }}
steps:
- run: echo This is a special branch!
```
### ERROR: Broken JSON string passed to fromJSON.
```
if: contains(fromJSON('["main","release","dev"'), github.ref_name)
```
````
- Allow passing command arguments to `-shellcheck` argument. ([#​483](https://github.com/rhysd/actionlint/issues/483), thanks [@​anuraaga](https://github.com/anuraaga))
- This is useful when you want to use alternative build of shellcheck like [go-shellcheck](https://github.com/wasilibs/go-shellcheck/).
```sh
actionlint -shellcheck="go run github.com/wasilibs/go-shellcheck/cmd/shellcheck@latest"
```
- Support undocumented `repository_visibility`, `artifact_cache_size_limit`, `step_summary`, `output`, `state` properties in `github` context. ([#​489](https://github.com/rhysd/actionlint/issues/489), thanks [@​rasa](https://github.com/rasa) for adding `repository_visibility` property)
- Remove `macos-12` runner label from known labels because it was [dropped](https://github.com/actions/runner-images/issues/10721) from GitHub-hosted runners on Dec. 3 and is no longer available.
- Add `windows-2025` runner label to the known labels. The runner is in [public preview](https://github.blog/changelog/2024-12-19-windows-server-2025-is-now-in-public-preview/). ([#​491](https://github.com/rhysd/actionlint/issues/491), thanks [@​ericcornelissen](https://github.com/ericcornelissen))
- Add `black` to the list of colors for `branding.color` action metadata. ([#​485](https://github.com/rhysd/actionlint/issues/485), thanks [@​eifinger](https://github.com/eifinger))
- Add `table` to the list of icons for `branding.icon` action metadata.
- Fix parsing escaped `{` in `format()` function call's first argument.
- Fix the incorrect `join()` function overload. `join(s1: string, s2: string)` was wrongly accepted.
- Update popular actions data set to the latest.
- Add `download-artifact/v3-node20` to the data set. ([#​468](https://github.com/rhysd/actionlint/issues/468))
- Fix missing the `reviewdog/action-hadolint@v1` action input. ([#​487](https://github.com/rhysd/actionlint/issues/487), thanks [@​mi-wada](https://github.com/mi-wada))
- Link to the documents of the stable version in actionlint `man` page and `-help` output.
- Refactor `LintStdin()` API example and some unit tests. ([#​472](https://github.com/rhysd/actionlint/issues/472), [#​475](https://github.com/rhysd/actionlint/issues/475), thanks [@​alexandear](https://github.com/alexandear))
- Improve the configuration example in `actionlint.yaml` document to explain glob patterns for `paths`. ([#​481](https://github.com/rhysd/actionlint/issues/481))
[Changes][v1.7.5]
<a id="v1.7.4"></a>
````
### [`v1.7.4`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v174---2024-11-04)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.3...v1.7.4)
- Disallow the usage of popular actions that run on `node16` runner. The `node16` runner [will reach the end of life on November 12](https://github.blog/changelog/2024-09-25-end-of-life-for-actions-node16/).
- In case of the error, please update your actions to the latest version so that they run on the latest `node20` runner.
- If you're using self-hosted runner and you cannot upgrade your runner to `node20` soon, please consider to ignore the error by the `paths` configuration described below.
- If you're using `actions/upload-artifact@v3` and `actions/download-artifact@v3` on GHES, please replace them with `actions/upload-artifact@v3-node20` and `actions/download-artifact@v3-node20`. ([#​468](https://github.com/rhysd/actionlint/issues/468))
- Provide the configuration for ignoring errors by regular expressions in `actionlint.yml` (or `actionlint.yaml`). Please see the [document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/config.md) for more details. ([#​217](https://github.com/rhysd/actionlint/issues/217), [#​342](https://github.com/rhysd/actionlint/issues/342))
- The `paths` is a mapping from the file path glob pattern to the corresponding configuration. The `ignore` configuration is a list of regular expressions to match error messages (similar to the `-ignore` command line option).
```yaml
paths:
```
### This pattern matches any YAML file under the '.github/workflows/' directory.
```
.github/workflows/**/*.yaml:
ignore:
```
### Ignore the specific error from shellcheck
```
- 'shellcheck reported issue in this script: SC2086:.+'
```
### This pattern only matches '.github/workflows/release.yaml' file.
```
.github/workflows/release.yaml:
ignore:
```
### Ignore errors from the old runner check. This may be useful for (outdated) self-hosted runner environment.
````
- 'the runner of ".+" action is too old to run on GitHub Actions'
```
````
- This configuration was not implemented initially because I wanted to keep the configuration as minimal as possible. However, due to several requests for it, the configuration has now been added.
- Untrusted inputs check is safely skipped inside specific function calls. ([#​459](https://github.com/rhysd/actionlint/issues/459), thanks [@​IlyaGulya](https://github.com/IlyaGulya))
- For example, the following step contains the untrusted input `github.head_ref`, but it is safe because it's passed to the `contains()` argument.
```yaml
- run: echo "is_release_branch=${{ contains(github.head_ref, 'release') }}" >> "$GITHUB_OUTPUT"
```
- For more details, please read the [rule document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/checks.md#untrusted-inputs).
- Recognize `gcr.io` and `gcr.dev` as the correct container registry hosts. ([#​463](https://github.com/rhysd/actionlint/issues/463), thanks [@​takaidohigasi](https://github.com/takaidohigasi))
- Note that it is recommended explicitly specifying the scheme like `docker://gcr.io/...`.
- Remove `macos-x.0` runner labels which are no longer available. ([#​452](https://github.com/rhysd/actionlint/issues/452))
- Disable shellcheck [`SC2043`](https://www.shellcheck.net/wiki/SC2043) rule because it can cause false positives on checking `run:`. ([#​355](https://github.com/rhysd/actionlint/issues/355))
- The [rule document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/checks.md#check-shellcheck-integ) was updated as well. ([#​466](https://github.com/rhysd/actionlint/issues/466), thanks [@​risu729](https://github.com/risu729))
- Fix the error message was not deterministic when detecting cycles in `needs` dependencies.
- Fix the check for `format()` function was not applied when the function name contains upper case like `Format()`. Note that function names in `${{ }}` placeholders are case-insensitive.
- Update the popular actions data set to the latest.
- This includes the [new `ref` and `commit` outputs](https://github.com/actions/checkout/pull/1180) of `actions/checkout`.
- Add [`actions/cache/save`](https://github.com/actions/cache/tree/main/save) and [`actions/cache/restore`](https://github.com/actions/cache/tree/main/restore) to the popular actions data set.
- Links in the [README.md](https://github.com/rhysd/actionlint/blob/main/README.md) now point to the document of the latest version tag instead of HEAD of `main` branch.
- Add [`Linter.LintStdin`](https://pkg.go.dev/github.com/rhysd/actionlint#Linter.LintStdin) method dedicated to linting STDIN instead of handling STDIN in `Command`.
- (Dev) Add new [`check-checks` script](https://github.com/rhysd/actionlint/tree/main/scripts/check-checks) to maintain the ['Checks' document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md). It automatically updates the outputs and playground links for example inputs in the document. It also checks the document is up-to-date on CI. Please read the [document](https://github.com/rhysd/actionlint/blob/main/scripts/check-checks/README.md) for more details.
[Documentation](https://github.com/rhysd/actionlint/tree/v1.7.4/docs)
\[Changes]\[v1.7.4]
<a id="v1.7.3"></a>
### [`v1.7.3`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v173---2024-09-29)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.2...v1.7.3)
- Remove `macos-11` runner labels because [macOS 11 runner was dropped on 6/28/2024](https://github.blog/changelog/2024-05-20-actions-upcoming-changes-to-github-hosted-macos-runners/#macos-11-deprecation-and-removal). ([#​451](https://github.com/rhysd/actionlint/issues/451), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- Support `macos-15`, `macos-15-large`, and `macos-15-xlarge` runner labels. The macOS 15 runner is not globally available yet, but [they are available in beta](https://github.com/actions/runner-images?tab=readme-ov-file#available-images). ([#​453](https://github.com/rhysd/actionlint/issues/453), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- Release artifact includes checksums for the released binaries. The file name is `actionlint_{version}_checksums.txt`. ([#​449](https://github.com/rhysd/actionlint/issues/449))
- For example, the checksums for v1.7.3 can be found [here](https://github.com/rhysd/actionlint/releases/download/v1.7.3/actionlint_1.7.3_checksums.txt).
- Fix `download-path` output is missing in `actions/download-artifact@v3` action. ([#​442](https://github.com/rhysd/actionlint/issues/442))
- Note that the latest version `actions/download-artifact@v4` was not affected by this issue.
- Support Go 1.23.
[Documentation](https://github.com/rhysd/actionlint/blob/v1.7.3/docs/checks.md)
\[Changes]\[v1.7.3]
<a id="v1.7.2"></a>
### [`v1.7.2`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v172---2024-09-23)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.1...v1.7.2)
- Fix child processes to run in parallel.
- Update the popular actions data set to the latest. ([#​442](https://github.com/rhysd/actionlint/issues/442), [#​445](https://github.com/rhysd/actionlint/issues/445), [#​446](https://github.com/rhysd/actionlint/issues/446), [#​447](https://github.com/rhysd/actionlint/issues/447), thanks [@​maikelvdh](https://github.com/maikelvdh))
- Add support for checking branch filters on [`merge_group` event](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#merge_group). ([#​448](https://github.com/rhysd/actionlint/issues/448), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- [The playground](https://rhysd.github.io/actionlint/) now supports both light and dark modes and automatically applies the system's theme.
- Fix releasing a failure on making a new winget package. ([#​438](https://github.com/rhysd/actionlint/issues/438), thanks [@​vedantmgoyal9](https://github.com/vedantmgoyal9))
\[Changes]\[v1.7.2]
<a id="v1.7.1"></a>
### [`v1.7.1`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v171---2024-05-28)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.0...v1.7.1)
- Support `ubuntu-24.04` runner label, which was [recently introduced as beta](https://github.blog/changelog/2024-05-14-github-hosted-runners-public-beta-of-ubuntu-24-04-is-now-available/). ([#​425](https://github.com/rhysd/actionlint/issues/425), thanks [@​bitcoin-tools](https://github.com/bitcoin-tools))
- Remove the support for `macos-10` runner label which was [officially dropped about 2 years ago](https://github.blog/changelog/2022-07-20-github-actions-the-macos-10-15-actions-runner-image-is-being-deprecated-and-will-be-removed-by-8-30-22/).
- Remove the support for `windows-2016` runner label which was [officially dropped about 2 years ago](https://github.blog/changelog/2021-10-19-github-actions-the-windows-2016-runner-image-will-be-removed-from-github-hosted-runners-on-march-15-2022/).
- Document URLs used in help output and links in the playground prefer specific version tag rather than `main` branch. For example,
- Before: https://github.com/rhysd/actionlint/tree/main/docs
- After: https://github.com/rhysd/actionlint/tree/v1.7.1/docs
- Fix actionlint wrongly reports an error when using `ghcr.io` or `docker.io` at `image` field of action metadata file of Docker action without `docker://` scheme. ([#​428](https://github.com/rhysd/actionlint/issues/428))
```yaml
runs:
using: 'docker'
```
### This should be OK
```
image: 'ghcr.io/user/repo:latest'
```
```
- Fix checking `preactjs/compressed-size-action@v2` usage caused a false positive. ([#​422](https://github.com/rhysd/actionlint/issues/422))
- Fix an error message when invalid escaping is found in globs.
- The design of the [playground page](https://rhysd.github.io/actionlint/) is overhauled following the upgrade of bulma package to v1.
- Current actionlint version is shown in the heading.
- The color theme is changed to the official dark theme.
- The list of useful links is added to the bottom of the page as 'Resources' section.
[Changes][v1.7.1]
<a id="v1.7.0"></a>
```
### [`v1.7.0`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v170---2024-05-08)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.6.27...v1.7.0)
- From this version, actionlint starts to check action metadata file `action.yml` (or `action.yaml`). At this point, only very basic checks are implemented and contents of `steps:` are not checked yet.
- It checks properties under `runs:` section (e.g. `main:` can be specified when it is a JavaScript action), `branding:` properties, and so on.
```yaml
name: 'My action'
author: '...'
```
### ERROR: 'description' section is missing
```
branding:
```
### ERROR: Invalid icon name
```
icon: dog
runs:
```
### ERROR: Node.js runtime version is too old
```
using: 'node12'
```
### ERROR: The source file being run by this action does not exist
```
main: 'this-file-does-not-exist.js'
```
### ERROR: 'env' configuration is only allowed for Docker actions
````
env:
SOME_VAR: SOME_VALUE
```
````
- actionlint still focuses on checking workflow files. So there is no way to directly specify `action.yml` as an argument of `actionlint` command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead.
- Checks for `steps:` contents are planned to be implemented. Since several differences are expected between `steps:` in workflow file and `steps:` in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected.
- Add `runner.environment` property. ([#​412](https://github.com/rhysd/actionlint/issues/412))
```yaml
- run: echo 'Run by GitHub-hosted runner'
if: runner.environment == 'github-hosted'
```
- Using outdated popular actions is now detected at error. See [the document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#detect-outdated-popular-actions) for more details.
- Here 'outdated' means actions which use runtimes no longer supported by GitHub-hosted runners such as `node12`.
```yaml
```
### ERROR: actions/checkout@v2 is using the outdated runner 'node12'
````
- uses: actions/checkout@v2
```
````
- Support `attestations` permission which was [recently added to GitHub Actions as beta](https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds). ([#​418](https://github.com/rhysd/actionlint/issues/418), thanks [@​bdehamer](https://github.com/bdehamer))
```yaml
permissions:
id-token: write
contents: read
attestations: write
```
- Check comparison expressions more strictly. Arbitrary types of operands can be compared as [the official document](https://docs.github.com/en/actions/learn-github-actions/expressions#operators) explains. However, comparisons between some types are actually meaningless because the values are converted to numbers implicitly. actionlint catches such meaningless comparisons as errors. Please see [the check document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-comparison-types) for more details.
```yaml
on:
workflow_call:
inputs:
timeout:
type: boolean
jobs:
test:
runs-on: ubuntu-latest
steps:
- run: echo 'called!'
```
### ERROR: Comparing string to object is always evaluated to false
```
if: ${{ github.event == 'workflow_call' }}
- run: echo 'timeout is too long'
```
### ERROR: Comparing boolean value with `>` doesn't make sense
```
if: ${{ inputs.timeout > 60 }}
```
````
- Follow the update that `macos-latest` is now an alias to `macos-14` runner.
- Support a custom python shell by `pyflakes` rule.
- Add workaround actionlint reports that `dorny/paths-filter`'s `predicate-quantifier` input is not defined. ([#​416](https://github.com/rhysd/actionlint/issues/416))
- Fix the type of a conditional expression by comparison operators is wider than expected by implementing type narrowing. ([#​384](https://github.com/rhysd/actionlint/issues/384))
- For example, the type of following expression should be `number` but it was actually `string | number` and actionlint complained that `timeout-minutes` must take a number value.
```yaml
timeout-minutes: ${{ env.FOO && 10 || 60 }}
```
- Fix `${{ }}` placeholder is not available at `jobs.<job_id>.services`. ([#​402](https://github.com/rhysd/actionlint/issues/402))
```yaml
jobs:
test:
services: ${{ fromJSON('...') }}
runs-on: ubuntu-latest
steps:
- run: ...
````
- Do not check outputs of `google-github-actions/get-secretmanager-secrets` because this action sets outputs dynamically. ([#​404](https://github.com/rhysd/actionlint/issues/404))
- Fix `defaults.run` is ignored on detecting the shell used in `run:`. ([#​409](https://github.com/rhysd/actionlint/issues/409))
```yaml
defaults:
run:
shell: pwsh
jobs:
test:
runs-on: ubuntu-latest
steps:
```
### This was wrongly detected as bash script
```
- run: $Env:FOO = "FOO"
```
````
- Fix parsing a syntax error reported from pyflakes when checking a Python script in `run:`. ([#​411](https://github.com/rhysd/actionlint/issues/411))
```yaml
- run: print(
shell: python
````
- Skip checking `exclude:` items in `matrix:` when they are constructed from `${{ }}` dynamically. ([#​414](https://github.com/rhysd/actionlint/issues/414))
```yaml
matrix:
foo: ['a', 'b']
exclude:
```
### actionlint complained this value didn't exist in matrix combinations
```
- foo: ${{ env.EXCLUDE_FOO }}
```
````
- Fix checking `exclude:` items when `${{ }}` is used in nested arrays at matrix items.
```yaml
matrix:
foo:
- ["${{ fromJSON('...') }}"]
exclude:
### actionlint complained this value didn't match to any matrix combinations
- foo: ['foo']
````
- Update popular actions data set. New major versions are added and the following actions are newly added.
- `peaceiris/actions-hugo`
- `actions/attest-build-provenance`
- `actions/add-to-project`
- `octokit/graphql-action`
- Update Go dependencies to the latest.
- Reduce the size of `actionlint` executable by removing redundant data from popular actions data set.
- x86\_64 executable binary size was reduced from 6.9MB to 6.7MB (2.9% smaller).
- Wasm binary size was reduced from 9.4MB to 8.9MB (5.3% smaller).
- Describe how to [integrate actionlint to Pulsar Edit](https://web.pulsar-edit.dev/packages/linter-github-actions) in [the document](https://github.com/rhysd/actionlint/blob/main/docs/usage.md#pulsar-edit). ([#​408](https://github.com/rhysd/actionlint/issues/408), thanks [@​mschuchard](https://github.com/mschuchard))
- Update outdated action versions in the usage document. ([#​413](https://github.com/rhysd/actionlint/issues/413), thanks [@​naglis](https://github.com/naglis))
\[Changes]\[v1.7.0]
<a id="v1.6.27"></a>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40My41IiwidXBkYXRlZEluVmVyIjoiNDEuNDMuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/791
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2025-08-02 17:56:34 +00:00
|
|
|
github.com/bmatcuk/doublestar/v4 v4.8.0 h1:DSXtrypQddoug1459viM9X9D3dp1Z7993fw36I2kNcQ=
|
|
|
|
|
github.com/bmatcuk/doublestar/v4 v4.8.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
|
2024-08-23 10:54:10 +00:00
|
|
|
github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
|
|
|
|
|
github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
|
2025-06-14 09:34:54 +00:00
|
|
|
github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
|
|
|
|
|
github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
|
2025-08-03 15:41:13 +00:00
|
|
|
github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
|
|
|
|
|
github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
|
2025-06-14 14:54:20 +00:00
|
|
|
github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
|
|
|
|
|
github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
|
2024-08-23 10:54:10 +00:00
|
|
|
github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
|
|
|
|
|
github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
|
2025-05-02 21:53:20 +00:00
|
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
|
2025-01-10 11:01:56 +00:00
|
|
|
github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
|
|
|
|
|
github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
|
2025-08-02 23:00:47 +00:00
|
|
|
github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
|
|
|
|
|
github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
|
|
|
|
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
|
|
|
|
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
2025-05-14 08:16:27 +00:00
|
|
|
github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
|
|
|
|
|
github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
|
2025-08-02 20:25:54 +00:00
|
|
|
github.com/docker/cli v28.3.3+incompatible h1:fp9ZHAr1WWPGdIWBM1b3zLtgCF+83gRdVMTJsUeiyAo=
|
|
|
|
|
github.com/docker/cli v28.3.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
|
2025-07-31 08:38:03 +00:00
|
|
|
github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
|
|
|
|
|
github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
|
2023-08-10 01:45:25 +00:00
|
|
|
github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8=
|
|
|
|
|
github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40=
|
2025-08-10 18:25:59 +00:00
|
|
|
github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
|
|
|
|
|
github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
|
2023-03-17 09:45:46 +08:00
|
|
|
github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
|
|
|
|
|
github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
|
2025-08-02 23:00:47 +00:00
|
|
|
github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
|
|
|
|
|
github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
|
2023-05-04 18:45:01 +08:00
|
|
|
github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
|
|
|
|
|
github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
|
Update module github.com/rhysd/actionlint to v1.7.7 (#791)
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [github.com/rhysd/actionlint](https://github.com/rhysd/actionlint) | `v1.6.27` -> `v1.7.7` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
### Release Notes
<details>
<summary>rhysd/actionlint (github.com/rhysd/actionlint)</summary>
### [`v1.7.7`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v177---2025-01-19)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.6...v1.7.7)
- Support runner labels for [Linux arm64 hosted runners](https://github.blog/changelog/2025-01-16-linux-arm64-hosted-runners-now-available-for-free-in-public-repositories-public-preview/). ([#​503](https://github.com/rhysd/actionlint/issues/503), [#​504](https://github.com/rhysd/actionlint/issues/504), thanks [@​martincostello](https://github.com/martincostello))
- `ubuntu-24.04-arm`
- `ubuntu-22.04-arm`
- Update Go dependencies to the latest.
- Update the popular actions data set to the latest.
- Add Linux arm64 job to the CI workflow. Now actionlint is tested on the platform. ([#​507](https://github.com/rhysd/actionlint/issues/507), thanks [@​cclauss](https://github.com/cclauss))
\[Changes]\[v1.7.7]
<a id="v1.7.6"></a>
### [`v1.7.6`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v176---2025-01-04)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.5...v1.7.6)
- Using contexts at specific workflow keys is incorrectly reported as not allowed. Affected workflow keys are as follows. ([#​495](https://github.com/rhysd/actionlint/issues/495), [#​497](https://github.com/rhysd/actionlint/issues/497), [#​498](https://github.com/rhysd/actionlint/issues/498), [#​500](https://github.com/rhysd/actionlint/issues/500))
- `jobs.<job_id>.steps.with.args`
- `jobs.<job_id>.steps.with.entrypoint`
- `jobs.<job_id>.services.<service_id>.env`
- Update Go dependencies to the latest.
\[Changes]\[v1.7.6]
<a id="v1.7.5"></a>
### [`v1.7.5`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v175---2024-12-28)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.4...v1.7.5)
- Strictly check available contexts in `${{ }}` placeholders following the ['Context availability' table](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#context-availability) in the official document.
- For example, `jobs.<job_id>.defaults.run.shell` allows `env` context but `shell` workflow keys in other places allow no context.
```yaml
defaults:
run:
```
### ERROR: No context is available here
```
shell: ${{ env.SHELL }}
jobs:
test:
runs-on: ubuntu-latest
defaults:
run:
```
### OK: 'env' context is available here
```
shell: ${{ env.SHELL }}
steps:
- run: echo hello
```
### ERROR: No context is available here
````
shell: ${{ env.SHELL}}
```
````
- Check a string literal passed to `fromJSON()` call. This pattern is [popular](https://github.com/search?q=fromJSON%28%27+lang%3Ayaml\&type=code) to create array or object constants because GitHub Actions does not provide the literal syntax for them. See the [document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#contexts-and-built-in-functions) for more details. ([#​464](https://github.com/rhysd/actionlint/issues/464))
```yaml
jobs:
test:
```
### ERROR: Key 'mac' does not exist in the object returned by the fromJSON()
```
runs-on: ${{ fromJSON('{"win":"windows-latest","linux":"ubuntul-latest"}')['mac'] }}
steps:
- run: echo This is a special branch!
```
### ERROR: Broken JSON string passed to fromJSON.
```
if: contains(fromJSON('["main","release","dev"'), github.ref_name)
```
````
- Allow passing command arguments to `-shellcheck` argument. ([#​483](https://github.com/rhysd/actionlint/issues/483), thanks [@​anuraaga](https://github.com/anuraaga))
- This is useful when you want to use alternative build of shellcheck like [go-shellcheck](https://github.com/wasilibs/go-shellcheck/).
```sh
actionlint -shellcheck="go run github.com/wasilibs/go-shellcheck/cmd/shellcheck@latest"
```
- Support undocumented `repository_visibility`, `artifact_cache_size_limit`, `step_summary`, `output`, `state` properties in `github` context. ([#​489](https://github.com/rhysd/actionlint/issues/489), thanks [@​rasa](https://github.com/rasa) for adding `repository_visibility` property)
- Remove `macos-12` runner label from known labels because it was [dropped](https://github.com/actions/runner-images/issues/10721) from GitHub-hosted runners on Dec. 3 and is no longer available.
- Add `windows-2025` runner label to the known labels. The runner is in [public preview](https://github.blog/changelog/2024-12-19-windows-server-2025-is-now-in-public-preview/). ([#​491](https://github.com/rhysd/actionlint/issues/491), thanks [@​ericcornelissen](https://github.com/ericcornelissen))
- Add `black` to the list of colors for `branding.color` action metadata. ([#​485](https://github.com/rhysd/actionlint/issues/485), thanks [@​eifinger](https://github.com/eifinger))
- Add `table` to the list of icons for `branding.icon` action metadata.
- Fix parsing escaped `{` in `format()` function call's first argument.
- Fix the incorrect `join()` function overload. `join(s1: string, s2: string)` was wrongly accepted.
- Update popular actions data set to the latest.
- Add `download-artifact/v3-node20` to the data set. ([#​468](https://github.com/rhysd/actionlint/issues/468))
- Fix missing the `reviewdog/action-hadolint@v1` action input. ([#​487](https://github.com/rhysd/actionlint/issues/487), thanks [@​mi-wada](https://github.com/mi-wada))
- Link to the documents of the stable version in actionlint `man` page and `-help` output.
- Refactor `LintStdin()` API example and some unit tests. ([#​472](https://github.com/rhysd/actionlint/issues/472), [#​475](https://github.com/rhysd/actionlint/issues/475), thanks [@​alexandear](https://github.com/alexandear))
- Improve the configuration example in `actionlint.yaml` document to explain glob patterns for `paths`. ([#​481](https://github.com/rhysd/actionlint/issues/481))
[Changes][v1.7.5]
<a id="v1.7.4"></a>
````
### [`v1.7.4`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v174---2024-11-04)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.3...v1.7.4)
- Disallow the usage of popular actions that run on `node16` runner. The `node16` runner [will reach the end of life on November 12](https://github.blog/changelog/2024-09-25-end-of-life-for-actions-node16/).
- In case of the error, please update your actions to the latest version so that they run on the latest `node20` runner.
- If you're using self-hosted runner and you cannot upgrade your runner to `node20` soon, please consider to ignore the error by the `paths` configuration described below.
- If you're using `actions/upload-artifact@v3` and `actions/download-artifact@v3` on GHES, please replace them with `actions/upload-artifact@v3-node20` and `actions/download-artifact@v3-node20`. ([#​468](https://github.com/rhysd/actionlint/issues/468))
- Provide the configuration for ignoring errors by regular expressions in `actionlint.yml` (or `actionlint.yaml`). Please see the [document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/config.md) for more details. ([#​217](https://github.com/rhysd/actionlint/issues/217), [#​342](https://github.com/rhysd/actionlint/issues/342))
- The `paths` is a mapping from the file path glob pattern to the corresponding configuration. The `ignore` configuration is a list of regular expressions to match error messages (similar to the `-ignore` command line option).
```yaml
paths:
```
### This pattern matches any YAML file under the '.github/workflows/' directory.
```
.github/workflows/**/*.yaml:
ignore:
```
### Ignore the specific error from shellcheck
```
- 'shellcheck reported issue in this script: SC2086:.+'
```
### This pattern only matches '.github/workflows/release.yaml' file.
```
.github/workflows/release.yaml:
ignore:
```
### Ignore errors from the old runner check. This may be useful for (outdated) self-hosted runner environment.
````
- 'the runner of ".+" action is too old to run on GitHub Actions'
```
````
- This configuration was not implemented initially because I wanted to keep the configuration as minimal as possible. However, due to several requests for it, the configuration has now been added.
- Untrusted inputs check is safely skipped inside specific function calls. ([#​459](https://github.com/rhysd/actionlint/issues/459), thanks [@​IlyaGulya](https://github.com/IlyaGulya))
- For example, the following step contains the untrusted input `github.head_ref`, but it is safe because it's passed to the `contains()` argument.
```yaml
- run: echo "is_release_branch=${{ contains(github.head_ref, 'release') }}" >> "$GITHUB_OUTPUT"
```
- For more details, please read the [rule document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/checks.md#untrusted-inputs).
- Recognize `gcr.io` and `gcr.dev` as the correct container registry hosts. ([#​463](https://github.com/rhysd/actionlint/issues/463), thanks [@​takaidohigasi](https://github.com/takaidohigasi))
- Note that it is recommended explicitly specifying the scheme like `docker://gcr.io/...`.
- Remove `macos-x.0` runner labels which are no longer available. ([#​452](https://github.com/rhysd/actionlint/issues/452))
- Disable shellcheck [`SC2043`](https://www.shellcheck.net/wiki/SC2043) rule because it can cause false positives on checking `run:`. ([#​355](https://github.com/rhysd/actionlint/issues/355))
- The [rule document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/checks.md#check-shellcheck-integ) was updated as well. ([#​466](https://github.com/rhysd/actionlint/issues/466), thanks [@​risu729](https://github.com/risu729))
- Fix the error message was not deterministic when detecting cycles in `needs` dependencies.
- Fix the check for `format()` function was not applied when the function name contains upper case like `Format()`. Note that function names in `${{ }}` placeholders are case-insensitive.
- Update the popular actions data set to the latest.
- This includes the [new `ref` and `commit` outputs](https://github.com/actions/checkout/pull/1180) of `actions/checkout`.
- Add [`actions/cache/save`](https://github.com/actions/cache/tree/main/save) and [`actions/cache/restore`](https://github.com/actions/cache/tree/main/restore) to the popular actions data set.
- Links in the [README.md](https://github.com/rhysd/actionlint/blob/main/README.md) now point to the document of the latest version tag instead of HEAD of `main` branch.
- Add [`Linter.LintStdin`](https://pkg.go.dev/github.com/rhysd/actionlint#Linter.LintStdin) method dedicated to linting STDIN instead of handling STDIN in `Command`.
- (Dev) Add new [`check-checks` script](https://github.com/rhysd/actionlint/tree/main/scripts/check-checks) to maintain the ['Checks' document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md). It automatically updates the outputs and playground links for example inputs in the document. It also checks the document is up-to-date on CI. Please read the [document](https://github.com/rhysd/actionlint/blob/main/scripts/check-checks/README.md) for more details.
[Documentation](https://github.com/rhysd/actionlint/tree/v1.7.4/docs)
\[Changes]\[v1.7.4]
<a id="v1.7.3"></a>
### [`v1.7.3`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v173---2024-09-29)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.2...v1.7.3)
- Remove `macos-11` runner labels because [macOS 11 runner was dropped on 6/28/2024](https://github.blog/changelog/2024-05-20-actions-upcoming-changes-to-github-hosted-macos-runners/#macos-11-deprecation-and-removal). ([#​451](https://github.com/rhysd/actionlint/issues/451), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- Support `macos-15`, `macos-15-large`, and `macos-15-xlarge` runner labels. The macOS 15 runner is not globally available yet, but [they are available in beta](https://github.com/actions/runner-images?tab=readme-ov-file#available-images). ([#​453](https://github.com/rhysd/actionlint/issues/453), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- Release artifact includes checksums for the released binaries. The file name is `actionlint_{version}_checksums.txt`. ([#​449](https://github.com/rhysd/actionlint/issues/449))
- For example, the checksums for v1.7.3 can be found [here](https://github.com/rhysd/actionlint/releases/download/v1.7.3/actionlint_1.7.3_checksums.txt).
- Fix `download-path` output is missing in `actions/download-artifact@v3` action. ([#​442](https://github.com/rhysd/actionlint/issues/442))
- Note that the latest version `actions/download-artifact@v4` was not affected by this issue.
- Support Go 1.23.
[Documentation](https://github.com/rhysd/actionlint/blob/v1.7.3/docs/checks.md)
\[Changes]\[v1.7.3]
<a id="v1.7.2"></a>
### [`v1.7.2`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v172---2024-09-23)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.1...v1.7.2)
- Fix child processes to run in parallel.
- Update the popular actions data set to the latest. ([#​442](https://github.com/rhysd/actionlint/issues/442), [#​445](https://github.com/rhysd/actionlint/issues/445), [#​446](https://github.com/rhysd/actionlint/issues/446), [#​447](https://github.com/rhysd/actionlint/issues/447), thanks [@​maikelvdh](https://github.com/maikelvdh))
- Add support for checking branch filters on [`merge_group` event](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#merge_group). ([#​448](https://github.com/rhysd/actionlint/issues/448), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- [The playground](https://rhysd.github.io/actionlint/) now supports both light and dark modes and automatically applies the system's theme.
- Fix releasing a failure on making a new winget package. ([#​438](https://github.com/rhysd/actionlint/issues/438), thanks [@​vedantmgoyal9](https://github.com/vedantmgoyal9))
\[Changes]\[v1.7.2]
<a id="v1.7.1"></a>
### [`v1.7.1`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v171---2024-05-28)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.0...v1.7.1)
- Support `ubuntu-24.04` runner label, which was [recently introduced as beta](https://github.blog/changelog/2024-05-14-github-hosted-runners-public-beta-of-ubuntu-24-04-is-now-available/). ([#​425](https://github.com/rhysd/actionlint/issues/425), thanks [@​bitcoin-tools](https://github.com/bitcoin-tools))
- Remove the support for `macos-10` runner label which was [officially dropped about 2 years ago](https://github.blog/changelog/2022-07-20-github-actions-the-macos-10-15-actions-runner-image-is-being-deprecated-and-will-be-removed-by-8-30-22/).
- Remove the support for `windows-2016` runner label which was [officially dropped about 2 years ago](https://github.blog/changelog/2021-10-19-github-actions-the-windows-2016-runner-image-will-be-removed-from-github-hosted-runners-on-march-15-2022/).
- Document URLs used in help output and links in the playground prefer specific version tag rather than `main` branch. For example,
- Before: https://github.com/rhysd/actionlint/tree/main/docs
- After: https://github.com/rhysd/actionlint/tree/v1.7.1/docs
- Fix actionlint wrongly reports an error when using `ghcr.io` or `docker.io` at `image` field of action metadata file of Docker action without `docker://` scheme. ([#​428](https://github.com/rhysd/actionlint/issues/428))
```yaml
runs:
using: 'docker'
```
### This should be OK
```
image: 'ghcr.io/user/repo:latest'
```
```
- Fix checking `preactjs/compressed-size-action@v2` usage caused a false positive. ([#​422](https://github.com/rhysd/actionlint/issues/422))
- Fix an error message when invalid escaping is found in globs.
- The design of the [playground page](https://rhysd.github.io/actionlint/) is overhauled following the upgrade of bulma package to v1.
- Current actionlint version is shown in the heading.
- The color theme is changed to the official dark theme.
- The list of useful links is added to the bottom of the page as 'Resources' section.
[Changes][v1.7.1]
<a id="v1.7.0"></a>
```
### [`v1.7.0`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v170---2024-05-08)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.6.27...v1.7.0)
- From this version, actionlint starts to check action metadata file `action.yml` (or `action.yaml`). At this point, only very basic checks are implemented and contents of `steps:` are not checked yet.
- It checks properties under `runs:` section (e.g. `main:` can be specified when it is a JavaScript action), `branding:` properties, and so on.
```yaml
name: 'My action'
author: '...'
```
### ERROR: 'description' section is missing
```
branding:
```
### ERROR: Invalid icon name
```
icon: dog
runs:
```
### ERROR: Node.js runtime version is too old
```
using: 'node12'
```
### ERROR: The source file being run by this action does not exist
```
main: 'this-file-does-not-exist.js'
```
### ERROR: 'env' configuration is only allowed for Docker actions
````
env:
SOME_VAR: SOME_VALUE
```
````
- actionlint still focuses on checking workflow files. So there is no way to directly specify `action.yml` as an argument of `actionlint` command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead.
- Checks for `steps:` contents are planned to be implemented. Since several differences are expected between `steps:` in workflow file and `steps:` in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected.
- Add `runner.environment` property. ([#​412](https://github.com/rhysd/actionlint/issues/412))
```yaml
- run: echo 'Run by GitHub-hosted runner'
if: runner.environment == 'github-hosted'
```
- Using outdated popular actions is now detected at error. See [the document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#detect-outdated-popular-actions) for more details.
- Here 'outdated' means actions which use runtimes no longer supported by GitHub-hosted runners such as `node12`.
```yaml
```
### ERROR: actions/checkout@v2 is using the outdated runner 'node12'
````
- uses: actions/checkout@v2
```
````
- Support `attestations` permission which was [recently added to GitHub Actions as beta](https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds). ([#​418](https://github.com/rhysd/actionlint/issues/418), thanks [@​bdehamer](https://github.com/bdehamer))
```yaml
permissions:
id-token: write
contents: read
attestations: write
```
- Check comparison expressions more strictly. Arbitrary types of operands can be compared as [the official document](https://docs.github.com/en/actions/learn-github-actions/expressions#operators) explains. However, comparisons between some types are actually meaningless because the values are converted to numbers implicitly. actionlint catches such meaningless comparisons as errors. Please see [the check document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-comparison-types) for more details.
```yaml
on:
workflow_call:
inputs:
timeout:
type: boolean
jobs:
test:
runs-on: ubuntu-latest
steps:
- run: echo 'called!'
```
### ERROR: Comparing string to object is always evaluated to false
```
if: ${{ github.event == 'workflow_call' }}
- run: echo 'timeout is too long'
```
### ERROR: Comparing boolean value with `>` doesn't make sense
```
if: ${{ inputs.timeout > 60 }}
```
````
- Follow the update that `macos-latest` is now an alias to `macos-14` runner.
- Support a custom python shell by `pyflakes` rule.
- Add workaround actionlint reports that `dorny/paths-filter`'s `predicate-quantifier` input is not defined. ([#​416](https://github.com/rhysd/actionlint/issues/416))
- Fix the type of a conditional expression by comparison operators is wider than expected by implementing type narrowing. ([#​384](https://github.com/rhysd/actionlint/issues/384))
- For example, the type of following expression should be `number` but it was actually `string | number` and actionlint complained that `timeout-minutes` must take a number value.
```yaml
timeout-minutes: ${{ env.FOO && 10 || 60 }}
```
- Fix `${{ }}` placeholder is not available at `jobs.<job_id>.services`. ([#​402](https://github.com/rhysd/actionlint/issues/402))
```yaml
jobs:
test:
services: ${{ fromJSON('...') }}
runs-on: ubuntu-latest
steps:
- run: ...
````
- Do not check outputs of `google-github-actions/get-secretmanager-secrets` because this action sets outputs dynamically. ([#​404](https://github.com/rhysd/actionlint/issues/404))
- Fix `defaults.run` is ignored on detecting the shell used in `run:`. ([#​409](https://github.com/rhysd/actionlint/issues/409))
```yaml
defaults:
run:
shell: pwsh
jobs:
test:
runs-on: ubuntu-latest
steps:
```
### This was wrongly detected as bash script
```
- run: $Env:FOO = "FOO"
```
````
- Fix parsing a syntax error reported from pyflakes when checking a Python script in `run:`. ([#​411](https://github.com/rhysd/actionlint/issues/411))
```yaml
- run: print(
shell: python
````
- Skip checking `exclude:` items in `matrix:` when they are constructed from `${{ }}` dynamically. ([#​414](https://github.com/rhysd/actionlint/issues/414))
```yaml
matrix:
foo: ['a', 'b']
exclude:
```
### actionlint complained this value didn't exist in matrix combinations
```
- foo: ${{ env.EXCLUDE_FOO }}
```
````
- Fix checking `exclude:` items when `${{ }}` is used in nested arrays at matrix items.
```yaml
matrix:
foo:
- ["${{ fromJSON('...') }}"]
exclude:
### actionlint complained this value didn't match to any matrix combinations
- foo: ['foo']
````
- Update popular actions data set. New major versions are added and the following actions are newly added.
- `peaceiris/actions-hugo`
- `actions/attest-build-provenance`
- `actions/add-to-project`
- `octokit/graphql-action`
- Update Go dependencies to the latest.
- Reduce the size of `actionlint` executable by removing redundant data from popular actions data set.
- x86\_64 executable binary size was reduced from 6.9MB to 6.7MB (2.9% smaller).
- Wasm binary size was reduced from 9.4MB to 8.9MB (5.3% smaller).
- Describe how to [integrate actionlint to Pulsar Edit](https://web.pulsar-edit.dev/packages/linter-github-actions) in [the document](https://github.com/rhysd/actionlint/blob/main/docs/usage.md#pulsar-edit). ([#​408](https://github.com/rhysd/actionlint/issues/408), thanks [@​mschuchard](https://github.com/mschuchard))
- Update outdated action versions in the usage document. ([#​413](https://github.com/rhysd/actionlint/issues/413), thanks [@​naglis](https://github.com/naglis))
\[Changes]\[v1.7.0]
<a id="v1.6.27"></a>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40My41IiwidXBkYXRlZEluVmVyIjoiNDEuNDMuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/791
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2025-08-02 17:56:34 +00:00
|
|
|
github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
|
|
|
|
|
github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
|
2024-08-23 10:54:10 +00:00
|
|
|
github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
|
|
|
|
|
github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
|
2025-01-10 11:01:56 +00:00
|
|
|
github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
|
|
|
|
|
github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
|
2023-06-16 06:07:48 +00:00
|
|
|
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
|
|
|
|
|
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
|
2025-08-02 17:29:04 +00:00
|
|
|
github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
|
|
|
|
|
github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
|
2024-03-11 18:32:49 +07:00
|
|
|
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
|
|
|
|
|
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
|
2025-08-02 23:00:47 +00:00
|
|
|
github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM=
|
|
|
|
|
github.com/go-git/go-git/v5 v5.16.2/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
|
2024-08-23 10:54:10 +00:00
|
|
|
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
2025-05-14 08:16:27 +00:00
|
|
|
github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
|
|
|
|
|
github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
2024-08-23 10:54:10 +00:00
|
|
|
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
|
|
|
|
|
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
|
Update github.com/go-viper/mapstructure/v2 (indirect) to v2.3.0 [SECURITY] (#622)
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) | `v2.2.1` -> `v2.3.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
### mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data
[GHSA-fv92-fjc5-jj9h](https://github.com/advisories/GHSA-fv92-fjc5-jj9h)
<details>
<summary>More information</summary>
#### Details
##### Summary
Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.
##### Details
OpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows:
https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50
```go
_, _, err := d.getPrimitive(field, schema)
if err != nil {
return fmt.Errorf("error converting input for field %q: %w", field, err)
}
```
where this calls `mapstructure.WeakDecode(...)`: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193
```go
func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
raw, ok := d.Raw[k]
if !ok {
return nil, false, nil
}
switch t := schema.Type; t {
case TypeBool:
var result bool
if err := mapstructure.WeakDecode(raw, &result); err != nil {
return nil, false, err
}
return result, true, nil
```
Notably, `WeakDecode(...)` eventually calls one of the decode helpers, which surfaces the original value:
https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L679-L686
https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L726-L730
https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L783-L787
& more.
##### PoC
To reproduce with OpenBao:
```
$ podman run -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
```
and in a new tab:
```
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"password":{"asdf":"my-sensitive-value"}}' "http://localhost:8300/v1/auth/userpass/users/adsf"
{"errors":["error converting input for field \"password\": '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[asdf:my-sensitive-value]'"]}
```
##### Impact
This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `'' expected a map, got 'string'` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided).
This was rated 4.5 Medium by HashiCorp in the past iteration.
#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`
#### References
- [https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h](https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h)
- [https://github.com/go-viper/mapstructure](https://github.com/go-viper/mapstructure)
This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fv92-fjc5-jj9h) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Release Notes
<details>
<summary>go-viper/mapstructure (github.com/go-viper/mapstructure/v2)</summary>
### [`v2.3.0`](https://github.com/go-viper/mapstructure/releases/tag/v2.3.0)
[Compare Source](https://github.com/go-viper/mapstructure/compare/v2.2.1...v2.3.0)
#### What's Changed
- build(deps): bump actions/checkout from 4.1.7 to 4.2.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/46
- build(deps): bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/47
- \[enhancement] Add check for `reflect.Value` in `ComposeDecodeHookFunc` by [@​mahadzaryab1](https://github.com/mahadzaryab1) in https://github.com/go-viper/mapstructure/pull/52
- build(deps): bump actions/setup-go from 5.0.2 to 5.1.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/51
- build(deps): bump actions/checkout from 4.2.0 to 4.2.2 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/50
- build(deps): bump actions/setup-go from 5.1.0 to 5.2.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/55
- build(deps): bump actions/setup-go from 5.2.0 to 5.3.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/58
- ci: add Go 1.24 to the test matrix by [@​sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/74
- build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.5.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/72
- build(deps): bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/76
- build(deps): bump actions/setup-go from 5.3.0 to 5.4.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/78
- feat: add decode hook for netip.Prefix by [@​tklauser](https://github.com/tklauser) in https://github.com/go-viper/mapstructure/pull/85
- Updates by [@​sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/86
- build(deps): bump github/codeql-action from 2.13.4 to 3.28.15 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/87
- build(deps): bump actions/setup-go from 5.4.0 to 5.5.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/93
- build(deps): bump github/codeql-action from 3.28.15 to 3.28.17 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/92
- build(deps): bump github/codeql-action from 3.28.17 to 3.28.19 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/97
- build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/96
- Update README.md by [@​peczenyj](https://github.com/peczenyj) in https://github.com/go-viper/mapstructure/pull/90
- Add omitzero tag. by [@​Crystalix007](https://github.com/Crystalix007) in https://github.com/go-viper/mapstructure/pull/98
- Use error structs instead of duplicated strings by [@​m1k1o](https://github.com/m1k1o) in https://github.com/go-viper/mapstructure/pull/102
- build(deps): bump github/codeql-action from 3.28.19 to 3.29.0 by [@​dependabot](https://github.com/dependabot) in https://github.com/go-viper/mapstructure/pull/101
- feat: add common error interface by [@​sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/105
- update linter by [@​sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/106
- Feature allow unset pointer by [@​rostislaved](https://github.com/rostislaved) in https://github.com/go-viper/mapstructure/pull/80
#### New Contributors
- [@​tklauser](https://github.com/tklauser) made their first contribution in https://github.com/go-viper/mapstructure/pull/85
- [@​peczenyj](https://github.com/peczenyj) made their first contribution in https://github.com/go-viper/mapstructure/pull/90
- [@​Crystalix007](https://github.com/Crystalix007) made their first contribution in https://github.com/go-viper/mapstructure/pull/98
- [@​rostislaved](https://github.com/rostislaved) made their first contribution in https://github.com/go-viper/mapstructure/pull/80
**Full Changelog**: https://github.com/go-viper/mapstructure/compare/v2.2.1...v2.3.0
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xLjQiLCJ1cGRhdGVkSW5WZXIiOiI0MS4xLjQiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/622
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2025-06-29 07:35:20 +00:00
|
|
|
github.com/go-viper/mapstructure/v2 v2.3.0 h1:27XbWsHIqhbdR5TIC911OfYvgSaW93HM+dX7970Q7jk=
|
|
|
|
|
github.com/go-viper/mapstructure/v2 v2.3.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
|
2023-06-16 06:07:48 +00:00
|
|
|
github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
|
|
|
|
|
github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
|
|
|
|
|
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
|
2025-08-02 23:00:47 +00:00
|
|
|
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
|
|
|
|
|
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
|
2025-06-14 14:54:20 +00:00
|
|
|
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
|
|
|
|
|
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
|
2022-11-22 15:34:13 +08:00
|
|
|
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
|
|
|
|
|
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
|
2024-08-13 13:23:36 +00:00
|
|
|
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
|
|
|
|
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
2024-08-23 10:54:10 +00:00
|
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
|
|
|
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
|
2023-05-04 18:45:01 +08:00
|
|
|
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
|
|
|
|
|
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
|
|
|
|
|
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
|
2023-03-17 09:45:46 +08:00
|
|
|
github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
|
|
|
|
|
github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=
|
|
|
|
|
github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
|
|
|
|
|
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
|
|
|
|
|
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
|
2022-08-12 14:59:58 +08:00
|
|
|
github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
|
|
|
|
|
github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
|
|
|
|
|
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
2025-06-14 14:54:20 +00:00
|
|
|
github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
|
|
|
|
|
github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
|
2023-08-02 04:34:36 +00:00
|
|
|
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
|
2023-08-10 01:45:25 +00:00
|
|
|
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
|
|
|
|
|
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
|
|
|
|
|
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
|
|
|
|
|
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
|
Update module github.com/rhysd/actionlint to v1.7.7 (#791)
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [github.com/rhysd/actionlint](https://github.com/rhysd/actionlint) | `v1.6.27` -> `v1.7.7` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
### Release Notes
<details>
<summary>rhysd/actionlint (github.com/rhysd/actionlint)</summary>
### [`v1.7.7`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v177---2025-01-19)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.6...v1.7.7)
- Support runner labels for [Linux arm64 hosted runners](https://github.blog/changelog/2025-01-16-linux-arm64-hosted-runners-now-available-for-free-in-public-repositories-public-preview/). ([#​503](https://github.com/rhysd/actionlint/issues/503), [#​504](https://github.com/rhysd/actionlint/issues/504), thanks [@​martincostello](https://github.com/martincostello))
- `ubuntu-24.04-arm`
- `ubuntu-22.04-arm`
- Update Go dependencies to the latest.
- Update the popular actions data set to the latest.
- Add Linux arm64 job to the CI workflow. Now actionlint is tested on the platform. ([#​507](https://github.com/rhysd/actionlint/issues/507), thanks [@​cclauss](https://github.com/cclauss))
\[Changes]\[v1.7.7]
<a id="v1.7.6"></a>
### [`v1.7.6`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v176---2025-01-04)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.5...v1.7.6)
- Using contexts at specific workflow keys is incorrectly reported as not allowed. Affected workflow keys are as follows. ([#​495](https://github.com/rhysd/actionlint/issues/495), [#​497](https://github.com/rhysd/actionlint/issues/497), [#​498](https://github.com/rhysd/actionlint/issues/498), [#​500](https://github.com/rhysd/actionlint/issues/500))
- `jobs.<job_id>.steps.with.args`
- `jobs.<job_id>.steps.with.entrypoint`
- `jobs.<job_id>.services.<service_id>.env`
- Update Go dependencies to the latest.
\[Changes]\[v1.7.6]
<a id="v1.7.5"></a>
### [`v1.7.5`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v175---2024-12-28)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.4...v1.7.5)
- Strictly check available contexts in `${{ }}` placeholders following the ['Context availability' table](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#context-availability) in the official document.
- For example, `jobs.<job_id>.defaults.run.shell` allows `env` context but `shell` workflow keys in other places allow no context.
```yaml
defaults:
run:
```
### ERROR: No context is available here
```
shell: ${{ env.SHELL }}
jobs:
test:
runs-on: ubuntu-latest
defaults:
run:
```
### OK: 'env' context is available here
```
shell: ${{ env.SHELL }}
steps:
- run: echo hello
```
### ERROR: No context is available here
````
shell: ${{ env.SHELL}}
```
````
- Check a string literal passed to `fromJSON()` call. This pattern is [popular](https://github.com/search?q=fromJSON%28%27+lang%3Ayaml\&type=code) to create array or object constants because GitHub Actions does not provide the literal syntax for them. See the [document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#contexts-and-built-in-functions) for more details. ([#​464](https://github.com/rhysd/actionlint/issues/464))
```yaml
jobs:
test:
```
### ERROR: Key 'mac' does not exist in the object returned by the fromJSON()
```
runs-on: ${{ fromJSON('{"win":"windows-latest","linux":"ubuntul-latest"}')['mac'] }}
steps:
- run: echo This is a special branch!
```
### ERROR: Broken JSON string passed to fromJSON.
```
if: contains(fromJSON('["main","release","dev"'), github.ref_name)
```
````
- Allow passing command arguments to `-shellcheck` argument. ([#​483](https://github.com/rhysd/actionlint/issues/483), thanks [@​anuraaga](https://github.com/anuraaga))
- This is useful when you want to use alternative build of shellcheck like [go-shellcheck](https://github.com/wasilibs/go-shellcheck/).
```sh
actionlint -shellcheck="go run github.com/wasilibs/go-shellcheck/cmd/shellcheck@latest"
```
- Support undocumented `repository_visibility`, `artifact_cache_size_limit`, `step_summary`, `output`, `state` properties in `github` context. ([#​489](https://github.com/rhysd/actionlint/issues/489), thanks [@​rasa](https://github.com/rasa) for adding `repository_visibility` property)
- Remove `macos-12` runner label from known labels because it was [dropped](https://github.com/actions/runner-images/issues/10721) from GitHub-hosted runners on Dec. 3 and is no longer available.
- Add `windows-2025` runner label to the known labels. The runner is in [public preview](https://github.blog/changelog/2024-12-19-windows-server-2025-is-now-in-public-preview/). ([#​491](https://github.com/rhysd/actionlint/issues/491), thanks [@​ericcornelissen](https://github.com/ericcornelissen))
- Add `black` to the list of colors for `branding.color` action metadata. ([#​485](https://github.com/rhysd/actionlint/issues/485), thanks [@​eifinger](https://github.com/eifinger))
- Add `table` to the list of icons for `branding.icon` action metadata.
- Fix parsing escaped `{` in `format()` function call's first argument.
- Fix the incorrect `join()` function overload. `join(s1: string, s2: string)` was wrongly accepted.
- Update popular actions data set to the latest.
- Add `download-artifact/v3-node20` to the data set. ([#​468](https://github.com/rhysd/actionlint/issues/468))
- Fix missing the `reviewdog/action-hadolint@v1` action input. ([#​487](https://github.com/rhysd/actionlint/issues/487), thanks [@​mi-wada](https://github.com/mi-wada))
- Link to the documents of the stable version in actionlint `man` page and `-help` output.
- Refactor `LintStdin()` API example and some unit tests. ([#​472](https://github.com/rhysd/actionlint/issues/472), [#​475](https://github.com/rhysd/actionlint/issues/475), thanks [@​alexandear](https://github.com/alexandear))
- Improve the configuration example in `actionlint.yaml` document to explain glob patterns for `paths`. ([#​481](https://github.com/rhysd/actionlint/issues/481))
[Changes][v1.7.5]
<a id="v1.7.4"></a>
````
### [`v1.7.4`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v174---2024-11-04)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.3...v1.7.4)
- Disallow the usage of popular actions that run on `node16` runner. The `node16` runner [will reach the end of life on November 12](https://github.blog/changelog/2024-09-25-end-of-life-for-actions-node16/).
- In case of the error, please update your actions to the latest version so that they run on the latest `node20` runner.
- If you're using self-hosted runner and you cannot upgrade your runner to `node20` soon, please consider to ignore the error by the `paths` configuration described below.
- If you're using `actions/upload-artifact@v3` and `actions/download-artifact@v3` on GHES, please replace them with `actions/upload-artifact@v3-node20` and `actions/download-artifact@v3-node20`. ([#​468](https://github.com/rhysd/actionlint/issues/468))
- Provide the configuration for ignoring errors by regular expressions in `actionlint.yml` (or `actionlint.yaml`). Please see the [document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/config.md) for more details. ([#​217](https://github.com/rhysd/actionlint/issues/217), [#​342](https://github.com/rhysd/actionlint/issues/342))
- The `paths` is a mapping from the file path glob pattern to the corresponding configuration. The `ignore` configuration is a list of regular expressions to match error messages (similar to the `-ignore` command line option).
```yaml
paths:
```
### This pattern matches any YAML file under the '.github/workflows/' directory.
```
.github/workflows/**/*.yaml:
ignore:
```
### Ignore the specific error from shellcheck
```
- 'shellcheck reported issue in this script: SC2086:.+'
```
### This pattern only matches '.github/workflows/release.yaml' file.
```
.github/workflows/release.yaml:
ignore:
```
### Ignore errors from the old runner check. This may be useful for (outdated) self-hosted runner environment.
````
- 'the runner of ".+" action is too old to run on GitHub Actions'
```
````
- This configuration was not implemented initially because I wanted to keep the configuration as minimal as possible. However, due to several requests for it, the configuration has now been added.
- Untrusted inputs check is safely skipped inside specific function calls. ([#​459](https://github.com/rhysd/actionlint/issues/459), thanks [@​IlyaGulya](https://github.com/IlyaGulya))
- For example, the following step contains the untrusted input `github.head_ref`, but it is safe because it's passed to the `contains()` argument.
```yaml
- run: echo "is_release_branch=${{ contains(github.head_ref, 'release') }}" >> "$GITHUB_OUTPUT"
```
- For more details, please read the [rule document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/checks.md#untrusted-inputs).
- Recognize `gcr.io` and `gcr.dev` as the correct container registry hosts. ([#​463](https://github.com/rhysd/actionlint/issues/463), thanks [@​takaidohigasi](https://github.com/takaidohigasi))
- Note that it is recommended explicitly specifying the scheme like `docker://gcr.io/...`.
- Remove `macos-x.0` runner labels which are no longer available. ([#​452](https://github.com/rhysd/actionlint/issues/452))
- Disable shellcheck [`SC2043`](https://www.shellcheck.net/wiki/SC2043) rule because it can cause false positives on checking `run:`. ([#​355](https://github.com/rhysd/actionlint/issues/355))
- The [rule document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/checks.md#check-shellcheck-integ) was updated as well. ([#​466](https://github.com/rhysd/actionlint/issues/466), thanks [@​risu729](https://github.com/risu729))
- Fix the error message was not deterministic when detecting cycles in `needs` dependencies.
- Fix the check for `format()` function was not applied when the function name contains upper case like `Format()`. Note that function names in `${{ }}` placeholders are case-insensitive.
- Update the popular actions data set to the latest.
- This includes the [new `ref` and `commit` outputs](https://github.com/actions/checkout/pull/1180) of `actions/checkout`.
- Add [`actions/cache/save`](https://github.com/actions/cache/tree/main/save) and [`actions/cache/restore`](https://github.com/actions/cache/tree/main/restore) to the popular actions data set.
- Links in the [README.md](https://github.com/rhysd/actionlint/blob/main/README.md) now point to the document of the latest version tag instead of HEAD of `main` branch.
- Add [`Linter.LintStdin`](https://pkg.go.dev/github.com/rhysd/actionlint#Linter.LintStdin) method dedicated to linting STDIN instead of handling STDIN in `Command`.
- (Dev) Add new [`check-checks` script](https://github.com/rhysd/actionlint/tree/main/scripts/check-checks) to maintain the ['Checks' document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md). It automatically updates the outputs and playground links for example inputs in the document. It also checks the document is up-to-date on CI. Please read the [document](https://github.com/rhysd/actionlint/blob/main/scripts/check-checks/README.md) for more details.
[Documentation](https://github.com/rhysd/actionlint/tree/v1.7.4/docs)
\[Changes]\[v1.7.4]
<a id="v1.7.3"></a>
### [`v1.7.3`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v173---2024-09-29)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.2...v1.7.3)
- Remove `macos-11` runner labels because [macOS 11 runner was dropped on 6/28/2024](https://github.blog/changelog/2024-05-20-actions-upcoming-changes-to-github-hosted-macos-runners/#macos-11-deprecation-and-removal). ([#​451](https://github.com/rhysd/actionlint/issues/451), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- Support `macos-15`, `macos-15-large`, and `macos-15-xlarge` runner labels. The macOS 15 runner is not globally available yet, but [they are available in beta](https://github.com/actions/runner-images?tab=readme-ov-file#available-images). ([#​453](https://github.com/rhysd/actionlint/issues/453), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- Release artifact includes checksums for the released binaries. The file name is `actionlint_{version}_checksums.txt`. ([#​449](https://github.com/rhysd/actionlint/issues/449))
- For example, the checksums for v1.7.3 can be found [here](https://github.com/rhysd/actionlint/releases/download/v1.7.3/actionlint_1.7.3_checksums.txt).
- Fix `download-path` output is missing in `actions/download-artifact@v3` action. ([#​442](https://github.com/rhysd/actionlint/issues/442))
- Note that the latest version `actions/download-artifact@v4` was not affected by this issue.
- Support Go 1.23.
[Documentation](https://github.com/rhysd/actionlint/blob/v1.7.3/docs/checks.md)
\[Changes]\[v1.7.3]
<a id="v1.7.2"></a>
### [`v1.7.2`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v172---2024-09-23)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.1...v1.7.2)
- Fix child processes to run in parallel.
- Update the popular actions data set to the latest. ([#​442](https://github.com/rhysd/actionlint/issues/442), [#​445](https://github.com/rhysd/actionlint/issues/445), [#​446](https://github.com/rhysd/actionlint/issues/446), [#​447](https://github.com/rhysd/actionlint/issues/447), thanks [@​maikelvdh](https://github.com/maikelvdh))
- Add support for checking branch filters on [`merge_group` event](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#merge_group). ([#​448](https://github.com/rhysd/actionlint/issues/448), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- [The playground](https://rhysd.github.io/actionlint/) now supports both light and dark modes and automatically applies the system's theme.
- Fix releasing a failure on making a new winget package. ([#​438](https://github.com/rhysd/actionlint/issues/438), thanks [@​vedantmgoyal9](https://github.com/vedantmgoyal9))
\[Changes]\[v1.7.2]
<a id="v1.7.1"></a>
### [`v1.7.1`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v171---2024-05-28)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.0...v1.7.1)
- Support `ubuntu-24.04` runner label, which was [recently introduced as beta](https://github.blog/changelog/2024-05-14-github-hosted-runners-public-beta-of-ubuntu-24-04-is-now-available/). ([#​425](https://github.com/rhysd/actionlint/issues/425), thanks [@​bitcoin-tools](https://github.com/bitcoin-tools))
- Remove the support for `macos-10` runner label which was [officially dropped about 2 years ago](https://github.blog/changelog/2022-07-20-github-actions-the-macos-10-15-actions-runner-image-is-being-deprecated-and-will-be-removed-by-8-30-22/).
- Remove the support for `windows-2016` runner label which was [officially dropped about 2 years ago](https://github.blog/changelog/2021-10-19-github-actions-the-windows-2016-runner-image-will-be-removed-from-github-hosted-runners-on-march-15-2022/).
- Document URLs used in help output and links in the playground prefer specific version tag rather than `main` branch. For example,
- Before: https://github.com/rhysd/actionlint/tree/main/docs
- After: https://github.com/rhysd/actionlint/tree/v1.7.1/docs
- Fix actionlint wrongly reports an error when using `ghcr.io` or `docker.io` at `image` field of action metadata file of Docker action without `docker://` scheme. ([#​428](https://github.com/rhysd/actionlint/issues/428))
```yaml
runs:
using: 'docker'
```
### This should be OK
```
image: 'ghcr.io/user/repo:latest'
```
```
- Fix checking `preactjs/compressed-size-action@v2` usage caused a false positive. ([#​422](https://github.com/rhysd/actionlint/issues/422))
- Fix an error message when invalid escaping is found in globs.
- The design of the [playground page](https://rhysd.github.io/actionlint/) is overhauled following the upgrade of bulma package to v1.
- Current actionlint version is shown in the heading.
- The color theme is changed to the official dark theme.
- The list of useful links is added to the bottom of the page as 'Resources' section.
[Changes][v1.7.1]
<a id="v1.7.0"></a>
```
### [`v1.7.0`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v170---2024-05-08)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.6.27...v1.7.0)
- From this version, actionlint starts to check action metadata file `action.yml` (or `action.yaml`). At this point, only very basic checks are implemented and contents of `steps:` are not checked yet.
- It checks properties under `runs:` section (e.g. `main:` can be specified when it is a JavaScript action), `branding:` properties, and so on.
```yaml
name: 'My action'
author: '...'
```
### ERROR: 'description' section is missing
```
branding:
```
### ERROR: Invalid icon name
```
icon: dog
runs:
```
### ERROR: Node.js runtime version is too old
```
using: 'node12'
```
### ERROR: The source file being run by this action does not exist
```
main: 'this-file-does-not-exist.js'
```
### ERROR: 'env' configuration is only allowed for Docker actions
````
env:
SOME_VAR: SOME_VALUE
```
````
- actionlint still focuses on checking workflow files. So there is no way to directly specify `action.yml` as an argument of `actionlint` command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead.
- Checks for `steps:` contents are planned to be implemented. Since several differences are expected between `steps:` in workflow file and `steps:` in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected.
- Add `runner.environment` property. ([#​412](https://github.com/rhysd/actionlint/issues/412))
```yaml
- run: echo 'Run by GitHub-hosted runner'
if: runner.environment == 'github-hosted'
```
- Using outdated popular actions is now detected at error. See [the document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#detect-outdated-popular-actions) for more details.
- Here 'outdated' means actions which use runtimes no longer supported by GitHub-hosted runners such as `node12`.
```yaml
```
### ERROR: actions/checkout@v2 is using the outdated runner 'node12'
````
- uses: actions/checkout@v2
```
````
- Support `attestations` permission which was [recently added to GitHub Actions as beta](https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds). ([#​418](https://github.com/rhysd/actionlint/issues/418), thanks [@​bdehamer](https://github.com/bdehamer))
```yaml
permissions:
id-token: write
contents: read
attestations: write
```
- Check comparison expressions more strictly. Arbitrary types of operands can be compared as [the official document](https://docs.github.com/en/actions/learn-github-actions/expressions#operators) explains. However, comparisons between some types are actually meaningless because the values are converted to numbers implicitly. actionlint catches such meaningless comparisons as errors. Please see [the check document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-comparison-types) for more details.
```yaml
on:
workflow_call:
inputs:
timeout:
type: boolean
jobs:
test:
runs-on: ubuntu-latest
steps:
- run: echo 'called!'
```
### ERROR: Comparing string to object is always evaluated to false
```
if: ${{ github.event == 'workflow_call' }}
- run: echo 'timeout is too long'
```
### ERROR: Comparing boolean value with `>` doesn't make sense
```
if: ${{ inputs.timeout > 60 }}
```
````
- Follow the update that `macos-latest` is now an alias to `macos-14` runner.
- Support a custom python shell by `pyflakes` rule.
- Add workaround actionlint reports that `dorny/paths-filter`'s `predicate-quantifier` input is not defined. ([#​416](https://github.com/rhysd/actionlint/issues/416))
- Fix the type of a conditional expression by comparison operators is wider than expected by implementing type narrowing. ([#​384](https://github.com/rhysd/actionlint/issues/384))
- For example, the type of following expression should be `number` but it was actually `string | number` and actionlint complained that `timeout-minutes` must take a number value.
```yaml
timeout-minutes: ${{ env.FOO && 10 || 60 }}
```
- Fix `${{ }}` placeholder is not available at `jobs.<job_id>.services`. ([#​402](https://github.com/rhysd/actionlint/issues/402))
```yaml
jobs:
test:
services: ${{ fromJSON('...') }}
runs-on: ubuntu-latest
steps:
- run: ...
````
- Do not check outputs of `google-github-actions/get-secretmanager-secrets` because this action sets outputs dynamically. ([#​404](https://github.com/rhysd/actionlint/issues/404))
- Fix `defaults.run` is ignored on detecting the shell used in `run:`. ([#​409](https://github.com/rhysd/actionlint/issues/409))
```yaml
defaults:
run:
shell: pwsh
jobs:
test:
runs-on: ubuntu-latest
steps:
```
### This was wrongly detected as bash script
```
- run: $Env:FOO = "FOO"
```
````
- Fix parsing a syntax error reported from pyflakes when checking a Python script in `run:`. ([#​411](https://github.com/rhysd/actionlint/issues/411))
```yaml
- run: print(
shell: python
````
- Skip checking `exclude:` items in `matrix:` when they are constructed from `${{ }}` dynamically. ([#​414](https://github.com/rhysd/actionlint/issues/414))
```yaml
matrix:
foo: ['a', 'b']
exclude:
```
### actionlint complained this value didn't exist in matrix combinations
```
- foo: ${{ env.EXCLUDE_FOO }}
```
````
- Fix checking `exclude:` items when `${{ }}` is used in nested arrays at matrix items.
```yaml
matrix:
foo:
- ["${{ fromJSON('...') }}"]
exclude:
### actionlint complained this value didn't match to any matrix combinations
- foo: ['foo']
````
- Update popular actions data set. New major versions are added and the following actions are newly added.
- `peaceiris/actions-hugo`
- `actions/attest-build-provenance`
- `actions/add-to-project`
- `octokit/graphql-action`
- Update Go dependencies to the latest.
- Reduce the size of `actionlint` executable by removing redundant data from popular actions data set.
- x86\_64 executable binary size was reduced from 6.9MB to 6.7MB (2.9% smaller).
- Wasm binary size was reduced from 9.4MB to 8.9MB (5.3% smaller).
- Describe how to [integrate actionlint to Pulsar Edit](https://web.pulsar-edit.dev/packages/linter-github-actions) in [the document](https://github.com/rhysd/actionlint/blob/main/docs/usage.md#pulsar-edit). ([#​408](https://github.com/rhysd/actionlint/issues/408), thanks [@​mschuchard](https://github.com/mschuchard))
- Update outdated action versions in the usage document. ([#​413](https://github.com/rhysd/actionlint/issues/413), thanks [@​naglis](https://github.com/naglis))
\[Changes]\[v1.7.0]
<a id="v1.6.27"></a>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40My41IiwidXBkYXRlZEluVmVyIjoiNDEuNDMuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/791
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2025-08-02 17:56:34 +00:00
|
|
|
github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
|
|
|
|
|
github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
|
2024-03-11 18:32:49 +07:00
|
|
|
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
|
|
|
|
|
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
|
Update module github.com/rhysd/actionlint to v1.7.7 (#791)
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [github.com/rhysd/actionlint](https://github.com/rhysd/actionlint) | `v1.6.27` -> `v1.7.7` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
### Release Notes
<details>
<summary>rhysd/actionlint (github.com/rhysd/actionlint)</summary>
### [`v1.7.7`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v177---2025-01-19)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.6...v1.7.7)
- Support runner labels for [Linux arm64 hosted runners](https://github.blog/changelog/2025-01-16-linux-arm64-hosted-runners-now-available-for-free-in-public-repositories-public-preview/). ([#​503](https://github.com/rhysd/actionlint/issues/503), [#​504](https://github.com/rhysd/actionlint/issues/504), thanks [@​martincostello](https://github.com/martincostello))
- `ubuntu-24.04-arm`
- `ubuntu-22.04-arm`
- Update Go dependencies to the latest.
- Update the popular actions data set to the latest.
- Add Linux arm64 job to the CI workflow. Now actionlint is tested on the platform. ([#​507](https://github.com/rhysd/actionlint/issues/507), thanks [@​cclauss](https://github.com/cclauss))
\[Changes]\[v1.7.7]
<a id="v1.7.6"></a>
### [`v1.7.6`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v176---2025-01-04)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.5...v1.7.6)
- Using contexts at specific workflow keys is incorrectly reported as not allowed. Affected workflow keys are as follows. ([#​495](https://github.com/rhysd/actionlint/issues/495), [#​497](https://github.com/rhysd/actionlint/issues/497), [#​498](https://github.com/rhysd/actionlint/issues/498), [#​500](https://github.com/rhysd/actionlint/issues/500))
- `jobs.<job_id>.steps.with.args`
- `jobs.<job_id>.steps.with.entrypoint`
- `jobs.<job_id>.services.<service_id>.env`
- Update Go dependencies to the latest.
\[Changes]\[v1.7.6]
<a id="v1.7.5"></a>
### [`v1.7.5`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v175---2024-12-28)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.4...v1.7.5)
- Strictly check available contexts in `${{ }}` placeholders following the ['Context availability' table](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#context-availability) in the official document.
- For example, `jobs.<job_id>.defaults.run.shell` allows `env` context but `shell` workflow keys in other places allow no context.
```yaml
defaults:
run:
```
### ERROR: No context is available here
```
shell: ${{ env.SHELL }}
jobs:
test:
runs-on: ubuntu-latest
defaults:
run:
```
### OK: 'env' context is available here
```
shell: ${{ env.SHELL }}
steps:
- run: echo hello
```
### ERROR: No context is available here
````
shell: ${{ env.SHELL}}
```
````
- Check a string literal passed to `fromJSON()` call. This pattern is [popular](https://github.com/search?q=fromJSON%28%27+lang%3Ayaml\&type=code) to create array or object constants because GitHub Actions does not provide the literal syntax for them. See the [document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#contexts-and-built-in-functions) for more details. ([#​464](https://github.com/rhysd/actionlint/issues/464))
```yaml
jobs:
test:
```
### ERROR: Key 'mac' does not exist in the object returned by the fromJSON()
```
runs-on: ${{ fromJSON('{"win":"windows-latest","linux":"ubuntul-latest"}')['mac'] }}
steps:
- run: echo This is a special branch!
```
### ERROR: Broken JSON string passed to fromJSON.
```
if: contains(fromJSON('["main","release","dev"'), github.ref_name)
```
````
- Allow passing command arguments to `-shellcheck` argument. ([#​483](https://github.com/rhysd/actionlint/issues/483), thanks [@​anuraaga](https://github.com/anuraaga))
- This is useful when you want to use alternative build of shellcheck like [go-shellcheck](https://github.com/wasilibs/go-shellcheck/).
```sh
actionlint -shellcheck="go run github.com/wasilibs/go-shellcheck/cmd/shellcheck@latest"
```
- Support undocumented `repository_visibility`, `artifact_cache_size_limit`, `step_summary`, `output`, `state` properties in `github` context. ([#​489](https://github.com/rhysd/actionlint/issues/489), thanks [@​rasa](https://github.com/rasa) for adding `repository_visibility` property)
- Remove `macos-12` runner label from known labels because it was [dropped](https://github.com/actions/runner-images/issues/10721) from GitHub-hosted runners on Dec. 3 and is no longer available.
- Add `windows-2025` runner label to the known labels. The runner is in [public preview](https://github.blog/changelog/2024-12-19-windows-server-2025-is-now-in-public-preview/). ([#​491](https://github.com/rhysd/actionlint/issues/491), thanks [@​ericcornelissen](https://github.com/ericcornelissen))
- Add `black` to the list of colors for `branding.color` action metadata. ([#​485](https://github.com/rhysd/actionlint/issues/485), thanks [@​eifinger](https://github.com/eifinger))
- Add `table` to the list of icons for `branding.icon` action metadata.
- Fix parsing escaped `{` in `format()` function call's first argument.
- Fix the incorrect `join()` function overload. `join(s1: string, s2: string)` was wrongly accepted.
- Update popular actions data set to the latest.
- Add `download-artifact/v3-node20` to the data set. ([#​468](https://github.com/rhysd/actionlint/issues/468))
- Fix missing the `reviewdog/action-hadolint@v1` action input. ([#​487](https://github.com/rhysd/actionlint/issues/487), thanks [@​mi-wada](https://github.com/mi-wada))
- Link to the documents of the stable version in actionlint `man` page and `-help` output.
- Refactor `LintStdin()` API example and some unit tests. ([#​472](https://github.com/rhysd/actionlint/issues/472), [#​475](https://github.com/rhysd/actionlint/issues/475), thanks [@​alexandear](https://github.com/alexandear))
- Improve the configuration example in `actionlint.yaml` document to explain glob patterns for `paths`. ([#​481](https://github.com/rhysd/actionlint/issues/481))
[Changes][v1.7.5]
<a id="v1.7.4"></a>
````
### [`v1.7.4`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v174---2024-11-04)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.3...v1.7.4)
- Disallow the usage of popular actions that run on `node16` runner. The `node16` runner [will reach the end of life on November 12](https://github.blog/changelog/2024-09-25-end-of-life-for-actions-node16/).
- In case of the error, please update your actions to the latest version so that they run on the latest `node20` runner.
- If you're using self-hosted runner and you cannot upgrade your runner to `node20` soon, please consider to ignore the error by the `paths` configuration described below.
- If you're using `actions/upload-artifact@v3` and `actions/download-artifact@v3` on GHES, please replace them with `actions/upload-artifact@v3-node20` and `actions/download-artifact@v3-node20`. ([#​468](https://github.com/rhysd/actionlint/issues/468))
- Provide the configuration for ignoring errors by regular expressions in `actionlint.yml` (or `actionlint.yaml`). Please see the [document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/config.md) for more details. ([#​217](https://github.com/rhysd/actionlint/issues/217), [#​342](https://github.com/rhysd/actionlint/issues/342))
- The `paths` is a mapping from the file path glob pattern to the corresponding configuration. The `ignore` configuration is a list of regular expressions to match error messages (similar to the `-ignore` command line option).
```yaml
paths:
```
### This pattern matches any YAML file under the '.github/workflows/' directory.
```
.github/workflows/**/*.yaml:
ignore:
```
### Ignore the specific error from shellcheck
```
- 'shellcheck reported issue in this script: SC2086:.+'
```
### This pattern only matches '.github/workflows/release.yaml' file.
```
.github/workflows/release.yaml:
ignore:
```
### Ignore errors from the old runner check. This may be useful for (outdated) self-hosted runner environment.
````
- 'the runner of ".+" action is too old to run on GitHub Actions'
```
````
- This configuration was not implemented initially because I wanted to keep the configuration as minimal as possible. However, due to several requests for it, the configuration has now been added.
- Untrusted inputs check is safely skipped inside specific function calls. ([#​459](https://github.com/rhysd/actionlint/issues/459), thanks [@​IlyaGulya](https://github.com/IlyaGulya))
- For example, the following step contains the untrusted input `github.head_ref`, but it is safe because it's passed to the `contains()` argument.
```yaml
- run: echo "is_release_branch=${{ contains(github.head_ref, 'release') }}" >> "$GITHUB_OUTPUT"
```
- For more details, please read the [rule document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/checks.md#untrusted-inputs).
- Recognize `gcr.io` and `gcr.dev` as the correct container registry hosts. ([#​463](https://github.com/rhysd/actionlint/issues/463), thanks [@​takaidohigasi](https://github.com/takaidohigasi))
- Note that it is recommended explicitly specifying the scheme like `docker://gcr.io/...`.
- Remove `macos-x.0` runner labels which are no longer available. ([#​452](https://github.com/rhysd/actionlint/issues/452))
- Disable shellcheck [`SC2043`](https://www.shellcheck.net/wiki/SC2043) rule because it can cause false positives on checking `run:`. ([#​355](https://github.com/rhysd/actionlint/issues/355))
- The [rule document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/checks.md#check-shellcheck-integ) was updated as well. ([#​466](https://github.com/rhysd/actionlint/issues/466), thanks [@​risu729](https://github.com/risu729))
- Fix the error message was not deterministic when detecting cycles in `needs` dependencies.
- Fix the check for `format()` function was not applied when the function name contains upper case like `Format()`. Note that function names in `${{ }}` placeholders are case-insensitive.
- Update the popular actions data set to the latest.
- This includes the [new `ref` and `commit` outputs](https://github.com/actions/checkout/pull/1180) of `actions/checkout`.
- Add [`actions/cache/save`](https://github.com/actions/cache/tree/main/save) and [`actions/cache/restore`](https://github.com/actions/cache/tree/main/restore) to the popular actions data set.
- Links in the [README.md](https://github.com/rhysd/actionlint/blob/main/README.md) now point to the document of the latest version tag instead of HEAD of `main` branch.
- Add [`Linter.LintStdin`](https://pkg.go.dev/github.com/rhysd/actionlint#Linter.LintStdin) method dedicated to linting STDIN instead of handling STDIN in `Command`.
- (Dev) Add new [`check-checks` script](https://github.com/rhysd/actionlint/tree/main/scripts/check-checks) to maintain the ['Checks' document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md). It automatically updates the outputs and playground links for example inputs in the document. It also checks the document is up-to-date on CI. Please read the [document](https://github.com/rhysd/actionlint/blob/main/scripts/check-checks/README.md) for more details.
[Documentation](https://github.com/rhysd/actionlint/tree/v1.7.4/docs)
\[Changes]\[v1.7.4]
<a id="v1.7.3"></a>
### [`v1.7.3`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v173---2024-09-29)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.2...v1.7.3)
- Remove `macos-11` runner labels because [macOS 11 runner was dropped on 6/28/2024](https://github.blog/changelog/2024-05-20-actions-upcoming-changes-to-github-hosted-macos-runners/#macos-11-deprecation-and-removal). ([#​451](https://github.com/rhysd/actionlint/issues/451), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- Support `macos-15`, `macos-15-large`, and `macos-15-xlarge` runner labels. The macOS 15 runner is not globally available yet, but [they are available in beta](https://github.com/actions/runner-images?tab=readme-ov-file#available-images). ([#​453](https://github.com/rhysd/actionlint/issues/453), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- Release artifact includes checksums for the released binaries. The file name is `actionlint_{version}_checksums.txt`. ([#​449](https://github.com/rhysd/actionlint/issues/449))
- For example, the checksums for v1.7.3 can be found [here](https://github.com/rhysd/actionlint/releases/download/v1.7.3/actionlint_1.7.3_checksums.txt).
- Fix `download-path` output is missing in `actions/download-artifact@v3` action. ([#​442](https://github.com/rhysd/actionlint/issues/442))
- Note that the latest version `actions/download-artifact@v4` was not affected by this issue.
- Support Go 1.23.
[Documentation](https://github.com/rhysd/actionlint/blob/v1.7.3/docs/checks.md)
\[Changes]\[v1.7.3]
<a id="v1.7.2"></a>
### [`v1.7.2`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v172---2024-09-23)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.1...v1.7.2)
- Fix child processes to run in parallel.
- Update the popular actions data set to the latest. ([#​442](https://github.com/rhysd/actionlint/issues/442), [#​445](https://github.com/rhysd/actionlint/issues/445), [#​446](https://github.com/rhysd/actionlint/issues/446), [#​447](https://github.com/rhysd/actionlint/issues/447), thanks [@​maikelvdh](https://github.com/maikelvdh))
- Add support for checking branch filters on [`merge_group` event](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#merge_group). ([#​448](https://github.com/rhysd/actionlint/issues/448), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- [The playground](https://rhysd.github.io/actionlint/) now supports both light and dark modes and automatically applies the system's theme.
- Fix releasing a failure on making a new winget package. ([#​438](https://github.com/rhysd/actionlint/issues/438), thanks [@​vedantmgoyal9](https://github.com/vedantmgoyal9))
\[Changes]\[v1.7.2]
<a id="v1.7.1"></a>
### [`v1.7.1`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v171---2024-05-28)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.0...v1.7.1)
- Support `ubuntu-24.04` runner label, which was [recently introduced as beta](https://github.blog/changelog/2024-05-14-github-hosted-runners-public-beta-of-ubuntu-24-04-is-now-available/). ([#​425](https://github.com/rhysd/actionlint/issues/425), thanks [@​bitcoin-tools](https://github.com/bitcoin-tools))
- Remove the support for `macos-10` runner label which was [officially dropped about 2 years ago](https://github.blog/changelog/2022-07-20-github-actions-the-macos-10-15-actions-runner-image-is-being-deprecated-and-will-be-removed-by-8-30-22/).
- Remove the support for `windows-2016` runner label which was [officially dropped about 2 years ago](https://github.blog/changelog/2021-10-19-github-actions-the-windows-2016-runner-image-will-be-removed-from-github-hosted-runners-on-march-15-2022/).
- Document URLs used in help output and links in the playground prefer specific version tag rather than `main` branch. For example,
- Before: https://github.com/rhysd/actionlint/tree/main/docs
- After: https://github.com/rhysd/actionlint/tree/v1.7.1/docs
- Fix actionlint wrongly reports an error when using `ghcr.io` or `docker.io` at `image` field of action metadata file of Docker action without `docker://` scheme. ([#​428](https://github.com/rhysd/actionlint/issues/428))
```yaml
runs:
using: 'docker'
```
### This should be OK
```
image: 'ghcr.io/user/repo:latest'
```
```
- Fix checking `preactjs/compressed-size-action@v2` usage caused a false positive. ([#​422](https://github.com/rhysd/actionlint/issues/422))
- Fix an error message when invalid escaping is found in globs.
- The design of the [playground page](https://rhysd.github.io/actionlint/) is overhauled following the upgrade of bulma package to v1.
- Current actionlint version is shown in the heading.
- The color theme is changed to the official dark theme.
- The list of useful links is added to the bottom of the page as 'Resources' section.
[Changes][v1.7.1]
<a id="v1.7.0"></a>
```
### [`v1.7.0`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v170---2024-05-08)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.6.27...v1.7.0)
- From this version, actionlint starts to check action metadata file `action.yml` (or `action.yaml`). At this point, only very basic checks are implemented and contents of `steps:` are not checked yet.
- It checks properties under `runs:` section (e.g. `main:` can be specified when it is a JavaScript action), `branding:` properties, and so on.
```yaml
name: 'My action'
author: '...'
```
### ERROR: 'description' section is missing
```
branding:
```
### ERROR: Invalid icon name
```
icon: dog
runs:
```
### ERROR: Node.js runtime version is too old
```
using: 'node12'
```
### ERROR: The source file being run by this action does not exist
```
main: 'this-file-does-not-exist.js'
```
### ERROR: 'env' configuration is only allowed for Docker actions
````
env:
SOME_VAR: SOME_VALUE
```
````
- actionlint still focuses on checking workflow files. So there is no way to directly specify `action.yml` as an argument of `actionlint` command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead.
- Checks for `steps:` contents are planned to be implemented. Since several differences are expected between `steps:` in workflow file and `steps:` in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected.
- Add `runner.environment` property. ([#​412](https://github.com/rhysd/actionlint/issues/412))
```yaml
- run: echo 'Run by GitHub-hosted runner'
if: runner.environment == 'github-hosted'
```
- Using outdated popular actions is now detected at error. See [the document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#detect-outdated-popular-actions) for more details.
- Here 'outdated' means actions which use runtimes no longer supported by GitHub-hosted runners such as `node12`.
```yaml
```
### ERROR: actions/checkout@v2 is using the outdated runner 'node12'
````
- uses: actions/checkout@v2
```
````
- Support `attestations` permission which was [recently added to GitHub Actions as beta](https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds). ([#​418](https://github.com/rhysd/actionlint/issues/418), thanks [@​bdehamer](https://github.com/bdehamer))
```yaml
permissions:
id-token: write
contents: read
attestations: write
```
- Check comparison expressions more strictly. Arbitrary types of operands can be compared as [the official document](https://docs.github.com/en/actions/learn-github-actions/expressions#operators) explains. However, comparisons between some types are actually meaningless because the values are converted to numbers implicitly. actionlint catches such meaningless comparisons as errors. Please see [the check document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-comparison-types) for more details.
```yaml
on:
workflow_call:
inputs:
timeout:
type: boolean
jobs:
test:
runs-on: ubuntu-latest
steps:
- run: echo 'called!'
```
### ERROR: Comparing string to object is always evaluated to false
```
if: ${{ github.event == 'workflow_call' }}
- run: echo 'timeout is too long'
```
### ERROR: Comparing boolean value with `>` doesn't make sense
```
if: ${{ inputs.timeout > 60 }}
```
````
- Follow the update that `macos-latest` is now an alias to `macos-14` runner.
- Support a custom python shell by `pyflakes` rule.
- Add workaround actionlint reports that `dorny/paths-filter`'s `predicate-quantifier` input is not defined. ([#​416](https://github.com/rhysd/actionlint/issues/416))
- Fix the type of a conditional expression by comparison operators is wider than expected by implementing type narrowing. ([#​384](https://github.com/rhysd/actionlint/issues/384))
- For example, the type of following expression should be `number` but it was actually `string | number` and actionlint complained that `timeout-minutes` must take a number value.
```yaml
timeout-minutes: ${{ env.FOO && 10 || 60 }}
```
- Fix `${{ }}` placeholder is not available at `jobs.<job_id>.services`. ([#​402](https://github.com/rhysd/actionlint/issues/402))
```yaml
jobs:
test:
services: ${{ fromJSON('...') }}
runs-on: ubuntu-latest
steps:
- run: ...
````
- Do not check outputs of `google-github-actions/get-secretmanager-secrets` because this action sets outputs dynamically. ([#​404](https://github.com/rhysd/actionlint/issues/404))
- Fix `defaults.run` is ignored on detecting the shell used in `run:`. ([#​409](https://github.com/rhysd/actionlint/issues/409))
```yaml
defaults:
run:
shell: pwsh
jobs:
test:
runs-on: ubuntu-latest
steps:
```
### This was wrongly detected as bash script
```
- run: $Env:FOO = "FOO"
```
````
- Fix parsing a syntax error reported from pyflakes when checking a Python script in `run:`. ([#​411](https://github.com/rhysd/actionlint/issues/411))
```yaml
- run: print(
shell: python
````
- Skip checking `exclude:` items in `matrix:` when they are constructed from `${{ }}` dynamically. ([#​414](https://github.com/rhysd/actionlint/issues/414))
```yaml
matrix:
foo: ['a', 'b']
exclude:
```
### actionlint complained this value didn't exist in matrix combinations
```
- foo: ${{ env.EXCLUDE_FOO }}
```
````
- Fix checking `exclude:` items when `${{ }}` is used in nested arrays at matrix items.
```yaml
matrix:
foo:
- ["${{ fromJSON('...') }}"]
exclude:
### actionlint complained this value didn't match to any matrix combinations
- foo: ['foo']
````
- Update popular actions data set. New major versions are added and the following actions are newly added.
- `peaceiris/actions-hugo`
- `actions/attest-build-provenance`
- `actions/add-to-project`
- `octokit/graphql-action`
- Update Go dependencies to the latest.
- Reduce the size of `actionlint` executable by removing redundant data from popular actions data set.
- x86\_64 executable binary size was reduced from 6.9MB to 6.7MB (2.9% smaller).
- Wasm binary size was reduced from 9.4MB to 8.9MB (5.3% smaller).
- Describe how to [integrate actionlint to Pulsar Edit](https://web.pulsar-edit.dev/packages/linter-github-actions) in [the document](https://github.com/rhysd/actionlint/blob/main/docs/usage.md#pulsar-edit). ([#​408](https://github.com/rhysd/actionlint/issues/408), thanks [@​mschuchard](https://github.com/mschuchard))
- Update outdated action versions in the usage document. ([#​413](https://github.com/rhysd/actionlint/issues/413), thanks [@​naglis](https://github.com/naglis))
\[Changes]\[v1.7.0]
<a id="v1.6.27"></a>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40My41IiwidXBkYXRlZEluVmVyIjoiNDEuNDMuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/791
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2025-08-02 17:56:34 +00:00
|
|
|
github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
|
|
|
|
|
github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
|
|
|
|
|
github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
|
|
|
|
|
github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
|
2025-06-14 14:54:20 +00:00
|
|
|
github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
|
|
|
|
|
github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
|
|
|
|
|
github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
|
|
|
|
|
github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
|
2023-10-04 14:58:57 +02:00
|
|
|
github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
|
|
|
|
|
github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
|
2025-06-14 14:54:20 +00:00
|
|
|
github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
|
|
|
|
|
github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
|
|
|
|
|
github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
|
|
|
|
|
github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
|
|
|
|
|
github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
|
|
|
|
|
github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
|
2025-05-14 08:16:27 +00:00
|
|
|
github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
|
|
|
|
|
github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
|
2024-08-23 10:54:10 +00:00
|
|
|
github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
|
|
|
|
|
github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
|
2023-08-10 01:45:25 +00:00
|
|
|
github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
|
2025-01-10 11:01:56 +00:00
|
|
|
github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
|
|
|
|
|
github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
|
|
|
|
|
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
|
2025-08-02 18:44:09 +00:00
|
|
|
github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
|
|
|
|
|
github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
|
Update module github.com/opencontainers/selinux to v1.12.0 (#801)
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) | `v1.11.0` -> `v1.12.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
### Release Notes
<details>
<summary>opencontainers/selinux (github.com/opencontainers/selinux)</summary>
### [`v1.12.0`](https://github.com/opencontainers/selinux/releases/tag/v1.12.0)
[Compare Source](https://github.com/opencontainers/selinux/compare/v1.11.1...v1.12.0)
This release removes deprecated functions from the `label` package,
and improves documentation and error reporting of `SetCreateKey`.
#### What's Changed
- VERSION: remove by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/217
- CI: add AlmaLinux 8, CentOS Stream 9, and Fedora by [@​AkihiroSuda](https://github.com/AkihiroSuda) in https://github.com/opencontainers/selinux/pull/221
- ci: install git-core by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/224
- CI: add openSUSE Tumbleweed by [@​AkihiroSuda](https://github.com/AkihiroSuda) in https://github.com/opencontainers/selinux/pull/223
- Bump Go version, deps, fix some linter issues... by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/218
- label: remove deprecated stuff by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/228
- Improve SetKeyCreate error reporting, fix test flakes by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/227
**Full Changelog**: https://github.com/opencontainers/selinux/compare/v1.11.1...v1.12.0
### [`v1.11.1`](https://github.com/opencontainers/selinux/releases/tag/v1.11.1)
[Compare Source](https://github.com/opencontainers/selinux/compare/v1.11.0...v1.11.1)
#### What's Changed
- Bump to v1.11.0 by [@​rhatdan](https://github.com/rhatdan) in https://github.com/opencontainers/selinux/pull/197
- fix some error by [@​ningmingxiao](https://github.com/ningmingxiao) in https://github.com/opencontainers/selinux/pull/200
- ci: update Go 1.21 support by [@​michalbiesek](https://github.com/michalbiesek) in https://github.com/opencontainers/selinux/pull/202
- Extend `build-cross` target with `riscv64` arch by [@​michalbiesek](https://github.com/michalbiesek) in https://github.com/opencontainers/selinux/pull/201
- Remove nolint annotations for unix errno comparisons by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/203
- ci: bump some actions by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/205
- Misc nitpicks by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/206
- pwalk, pwalkdir: fix walk vs remove race by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/204
- Update GitHub Actions CI Go matrix for Go v1.22 by [@​austinvazquez](https://github.com/austinvazquez) in https://github.com/opencontainers/selinux/pull/209
- Update GitHub Actions packages to resolve deprecation warnings. by [@​austinvazquez](https://github.com/austinvazquez) in https://github.com/opencontainers/selinux/pull/208
- Add dependabot config by [@​kolyshkin](https://github.com/kolyshkin) in https://github.com/opencontainers/selinux/pull/210
- build(deps): bump tim-actions/get-pr-commits from 1.3.0 to 1.3.1 by [@​dependabot](https://github.com/dependabot) in https://github.com/opencontainers/selinux/pull/211
- build(deps): bump golangci/golangci-lint-action from 4 to 6 by [@​dependabot](https://github.com/dependabot) in https://github.com/opencontainers/selinux/pull/213
- Show SELinux label on failure by [@​rhatdan](https://github.com/rhatdan) in https://github.com/opencontainers/selinux/pull/216
#### New Contributors
- [@​ningmingxiao](https://github.com/ningmingxiao) made their first contribution in https://github.com/opencontainers/selinux/pull/200
- [@​michalbiesek](https://github.com/michalbiesek) made their first contribution in https://github.com/opencontainers/selinux/pull/202
- [@​dependabot](https://github.com/dependabot) made their first contribution in https://github.com/opencontainers/selinux/pull/211
**Full Changelog**: https://github.com/opencontainers/selinux/compare/v1.11.0...v1.11.1
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40My41IiwidXBkYXRlZEluVmVyIjoiNDEuNDMuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/801
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2025-08-02 23:47:31 +00:00
|
|
|
github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
|
|
|
|
|
github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
|
2025-08-02 23:00:47 +00:00
|
|
|
github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
|
|
|
|
|
github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
|
|
|
|
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
|
|
|
|
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
|
|
|
|
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
Update module github.com/rhysd/actionlint to v1.7.7 (#791)
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [github.com/rhysd/actionlint](https://github.com/rhysd/actionlint) | `v1.6.27` -> `v1.7.7` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
### Release Notes
<details>
<summary>rhysd/actionlint (github.com/rhysd/actionlint)</summary>
### [`v1.7.7`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v177---2025-01-19)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.6...v1.7.7)
- Support runner labels for [Linux arm64 hosted runners](https://github.blog/changelog/2025-01-16-linux-arm64-hosted-runners-now-available-for-free-in-public-repositories-public-preview/). ([#​503](https://github.com/rhysd/actionlint/issues/503), [#​504](https://github.com/rhysd/actionlint/issues/504), thanks [@​martincostello](https://github.com/martincostello))
- `ubuntu-24.04-arm`
- `ubuntu-22.04-arm`
- Update Go dependencies to the latest.
- Update the popular actions data set to the latest.
- Add Linux arm64 job to the CI workflow. Now actionlint is tested on the platform. ([#​507](https://github.com/rhysd/actionlint/issues/507), thanks [@​cclauss](https://github.com/cclauss))
\[Changes]\[v1.7.7]
<a id="v1.7.6"></a>
### [`v1.7.6`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v176---2025-01-04)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.5...v1.7.6)
- Using contexts at specific workflow keys is incorrectly reported as not allowed. Affected workflow keys are as follows. ([#​495](https://github.com/rhysd/actionlint/issues/495), [#​497](https://github.com/rhysd/actionlint/issues/497), [#​498](https://github.com/rhysd/actionlint/issues/498), [#​500](https://github.com/rhysd/actionlint/issues/500))
- `jobs.<job_id>.steps.with.args`
- `jobs.<job_id>.steps.with.entrypoint`
- `jobs.<job_id>.services.<service_id>.env`
- Update Go dependencies to the latest.
\[Changes]\[v1.7.6]
<a id="v1.7.5"></a>
### [`v1.7.5`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v175---2024-12-28)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.4...v1.7.5)
- Strictly check available contexts in `${{ }}` placeholders following the ['Context availability' table](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#context-availability) in the official document.
- For example, `jobs.<job_id>.defaults.run.shell` allows `env` context but `shell` workflow keys in other places allow no context.
```yaml
defaults:
run:
```
### ERROR: No context is available here
```
shell: ${{ env.SHELL }}
jobs:
test:
runs-on: ubuntu-latest
defaults:
run:
```
### OK: 'env' context is available here
```
shell: ${{ env.SHELL }}
steps:
- run: echo hello
```
### ERROR: No context is available here
````
shell: ${{ env.SHELL}}
```
````
- Check a string literal passed to `fromJSON()` call. This pattern is [popular](https://github.com/search?q=fromJSON%28%27+lang%3Ayaml\&type=code) to create array or object constants because GitHub Actions does not provide the literal syntax for them. See the [document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#contexts-and-built-in-functions) for more details. ([#​464](https://github.com/rhysd/actionlint/issues/464))
```yaml
jobs:
test:
```
### ERROR: Key 'mac' does not exist in the object returned by the fromJSON()
```
runs-on: ${{ fromJSON('{"win":"windows-latest","linux":"ubuntul-latest"}')['mac'] }}
steps:
- run: echo This is a special branch!
```
### ERROR: Broken JSON string passed to fromJSON.
```
if: contains(fromJSON('["main","release","dev"'), github.ref_name)
```
````
- Allow passing command arguments to `-shellcheck` argument. ([#​483](https://github.com/rhysd/actionlint/issues/483), thanks [@​anuraaga](https://github.com/anuraaga))
- This is useful when you want to use alternative build of shellcheck like [go-shellcheck](https://github.com/wasilibs/go-shellcheck/).
```sh
actionlint -shellcheck="go run github.com/wasilibs/go-shellcheck/cmd/shellcheck@latest"
```
- Support undocumented `repository_visibility`, `artifact_cache_size_limit`, `step_summary`, `output`, `state` properties in `github` context. ([#​489](https://github.com/rhysd/actionlint/issues/489), thanks [@​rasa](https://github.com/rasa) for adding `repository_visibility` property)
- Remove `macos-12` runner label from known labels because it was [dropped](https://github.com/actions/runner-images/issues/10721) from GitHub-hosted runners on Dec. 3 and is no longer available.
- Add `windows-2025` runner label to the known labels. The runner is in [public preview](https://github.blog/changelog/2024-12-19-windows-server-2025-is-now-in-public-preview/). ([#​491](https://github.com/rhysd/actionlint/issues/491), thanks [@​ericcornelissen](https://github.com/ericcornelissen))
- Add `black` to the list of colors for `branding.color` action metadata. ([#​485](https://github.com/rhysd/actionlint/issues/485), thanks [@​eifinger](https://github.com/eifinger))
- Add `table` to the list of icons for `branding.icon` action metadata.
- Fix parsing escaped `{` in `format()` function call's first argument.
- Fix the incorrect `join()` function overload. `join(s1: string, s2: string)` was wrongly accepted.
- Update popular actions data set to the latest.
- Add `download-artifact/v3-node20` to the data set. ([#​468](https://github.com/rhysd/actionlint/issues/468))
- Fix missing the `reviewdog/action-hadolint@v1` action input. ([#​487](https://github.com/rhysd/actionlint/issues/487), thanks [@​mi-wada](https://github.com/mi-wada))
- Link to the documents of the stable version in actionlint `man` page and `-help` output.
- Refactor `LintStdin()` API example and some unit tests. ([#​472](https://github.com/rhysd/actionlint/issues/472), [#​475](https://github.com/rhysd/actionlint/issues/475), thanks [@​alexandear](https://github.com/alexandear))
- Improve the configuration example in `actionlint.yaml` document to explain glob patterns for `paths`. ([#​481](https://github.com/rhysd/actionlint/issues/481))
[Changes][v1.7.5]
<a id="v1.7.4"></a>
````
### [`v1.7.4`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v174---2024-11-04)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.3...v1.7.4)
- Disallow the usage of popular actions that run on `node16` runner. The `node16` runner [will reach the end of life on November 12](https://github.blog/changelog/2024-09-25-end-of-life-for-actions-node16/).
- In case of the error, please update your actions to the latest version so that they run on the latest `node20` runner.
- If you're using self-hosted runner and you cannot upgrade your runner to `node20` soon, please consider to ignore the error by the `paths` configuration described below.
- If you're using `actions/upload-artifact@v3` and `actions/download-artifact@v3` on GHES, please replace them with `actions/upload-artifact@v3-node20` and `actions/download-artifact@v3-node20`. ([#​468](https://github.com/rhysd/actionlint/issues/468))
- Provide the configuration for ignoring errors by regular expressions in `actionlint.yml` (or `actionlint.yaml`). Please see the [document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/config.md) for more details. ([#​217](https://github.com/rhysd/actionlint/issues/217), [#​342](https://github.com/rhysd/actionlint/issues/342))
- The `paths` is a mapping from the file path glob pattern to the corresponding configuration. The `ignore` configuration is a list of regular expressions to match error messages (similar to the `-ignore` command line option).
```yaml
paths:
```
### This pattern matches any YAML file under the '.github/workflows/' directory.
```
.github/workflows/**/*.yaml:
ignore:
```
### Ignore the specific error from shellcheck
```
- 'shellcheck reported issue in this script: SC2086:.+'
```
### This pattern only matches '.github/workflows/release.yaml' file.
```
.github/workflows/release.yaml:
ignore:
```
### Ignore errors from the old runner check. This may be useful for (outdated) self-hosted runner environment.
````
- 'the runner of ".+" action is too old to run on GitHub Actions'
```
````
- This configuration was not implemented initially because I wanted to keep the configuration as minimal as possible. However, due to several requests for it, the configuration has now been added.
- Untrusted inputs check is safely skipped inside specific function calls. ([#​459](https://github.com/rhysd/actionlint/issues/459), thanks [@​IlyaGulya](https://github.com/IlyaGulya))
- For example, the following step contains the untrusted input `github.head_ref`, but it is safe because it's passed to the `contains()` argument.
```yaml
- run: echo "is_release_branch=${{ contains(github.head_ref, 'release') }}" >> "$GITHUB_OUTPUT"
```
- For more details, please read the [rule document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/checks.md#untrusted-inputs).
- Recognize `gcr.io` and `gcr.dev` as the correct container registry hosts. ([#​463](https://github.com/rhysd/actionlint/issues/463), thanks [@​takaidohigasi](https://github.com/takaidohigasi))
- Note that it is recommended explicitly specifying the scheme like `docker://gcr.io/...`.
- Remove `macos-x.0` runner labels which are no longer available. ([#​452](https://github.com/rhysd/actionlint/issues/452))
- Disable shellcheck [`SC2043`](https://www.shellcheck.net/wiki/SC2043) rule because it can cause false positives on checking `run:`. ([#​355](https://github.com/rhysd/actionlint/issues/355))
- The [rule document](https://github.com/rhysd/actionlint/blob/v1.7.4/docs/checks.md#check-shellcheck-integ) was updated as well. ([#​466](https://github.com/rhysd/actionlint/issues/466), thanks [@​risu729](https://github.com/risu729))
- Fix the error message was not deterministic when detecting cycles in `needs` dependencies.
- Fix the check for `format()` function was not applied when the function name contains upper case like `Format()`. Note that function names in `${{ }}` placeholders are case-insensitive.
- Update the popular actions data set to the latest.
- This includes the [new `ref` and `commit` outputs](https://github.com/actions/checkout/pull/1180) of `actions/checkout`.
- Add [`actions/cache/save`](https://github.com/actions/cache/tree/main/save) and [`actions/cache/restore`](https://github.com/actions/cache/tree/main/restore) to the popular actions data set.
- Links in the [README.md](https://github.com/rhysd/actionlint/blob/main/README.md) now point to the document of the latest version tag instead of HEAD of `main` branch.
- Add [`Linter.LintStdin`](https://pkg.go.dev/github.com/rhysd/actionlint#Linter.LintStdin) method dedicated to linting STDIN instead of handling STDIN in `Command`.
- (Dev) Add new [`check-checks` script](https://github.com/rhysd/actionlint/tree/main/scripts/check-checks) to maintain the ['Checks' document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md). It automatically updates the outputs and playground links for example inputs in the document. It also checks the document is up-to-date on CI. Please read the [document](https://github.com/rhysd/actionlint/blob/main/scripts/check-checks/README.md) for more details.
[Documentation](https://github.com/rhysd/actionlint/tree/v1.7.4/docs)
\[Changes]\[v1.7.4]
<a id="v1.7.3"></a>
### [`v1.7.3`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v173---2024-09-29)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.2...v1.7.3)
- Remove `macos-11` runner labels because [macOS 11 runner was dropped on 6/28/2024](https://github.blog/changelog/2024-05-20-actions-upcoming-changes-to-github-hosted-macos-runners/#macos-11-deprecation-and-removal). ([#​451](https://github.com/rhysd/actionlint/issues/451), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- Support `macos-15`, `macos-15-large`, and `macos-15-xlarge` runner labels. The macOS 15 runner is not globally available yet, but [they are available in beta](https://github.com/actions/runner-images?tab=readme-ov-file#available-images). ([#​453](https://github.com/rhysd/actionlint/issues/453), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- Release artifact includes checksums for the released binaries. The file name is `actionlint_{version}_checksums.txt`. ([#​449](https://github.com/rhysd/actionlint/issues/449))
- For example, the checksums for v1.7.3 can be found [here](https://github.com/rhysd/actionlint/releases/download/v1.7.3/actionlint_1.7.3_checksums.txt).
- Fix `download-path` output is missing in `actions/download-artifact@v3` action. ([#​442](https://github.com/rhysd/actionlint/issues/442))
- Note that the latest version `actions/download-artifact@v4` was not affected by this issue.
- Support Go 1.23.
[Documentation](https://github.com/rhysd/actionlint/blob/v1.7.3/docs/checks.md)
\[Changes]\[v1.7.3]
<a id="v1.7.2"></a>
### [`v1.7.2`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v172---2024-09-23)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.1...v1.7.2)
- Fix child processes to run in parallel.
- Update the popular actions data set to the latest. ([#​442](https://github.com/rhysd/actionlint/issues/442), [#​445](https://github.com/rhysd/actionlint/issues/445), [#​446](https://github.com/rhysd/actionlint/issues/446), [#​447](https://github.com/rhysd/actionlint/issues/447), thanks [@​maikelvdh](https://github.com/maikelvdh))
- Add support for checking branch filters on [`merge_group` event](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#merge_group). ([#​448](https://github.com/rhysd/actionlint/issues/448), thanks [@​muzimuzhi](https://github.com/muzimuzhi))
- [The playground](https://rhysd.github.io/actionlint/) now supports both light and dark modes and automatically applies the system's theme.
- Fix releasing a failure on making a new winget package. ([#​438](https://github.com/rhysd/actionlint/issues/438), thanks [@​vedantmgoyal9](https://github.com/vedantmgoyal9))
\[Changes]\[v1.7.2]
<a id="v1.7.1"></a>
### [`v1.7.1`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v171---2024-05-28)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.0...v1.7.1)
- Support `ubuntu-24.04` runner label, which was [recently introduced as beta](https://github.blog/changelog/2024-05-14-github-hosted-runners-public-beta-of-ubuntu-24-04-is-now-available/). ([#​425](https://github.com/rhysd/actionlint/issues/425), thanks [@​bitcoin-tools](https://github.com/bitcoin-tools))
- Remove the support for `macos-10` runner label which was [officially dropped about 2 years ago](https://github.blog/changelog/2022-07-20-github-actions-the-macos-10-15-actions-runner-image-is-being-deprecated-and-will-be-removed-by-8-30-22/).
- Remove the support for `windows-2016` runner label which was [officially dropped about 2 years ago](https://github.blog/changelog/2021-10-19-github-actions-the-windows-2016-runner-image-will-be-removed-from-github-hosted-runners-on-march-15-2022/).
- Document URLs used in help output and links in the playground prefer specific version tag rather than `main` branch. For example,
- Before: https://github.com/rhysd/actionlint/tree/main/docs
- After: https://github.com/rhysd/actionlint/tree/v1.7.1/docs
- Fix actionlint wrongly reports an error when using `ghcr.io` or `docker.io` at `image` field of action metadata file of Docker action without `docker://` scheme. ([#​428](https://github.com/rhysd/actionlint/issues/428))
```yaml
runs:
using: 'docker'
```
### This should be OK
```
image: 'ghcr.io/user/repo:latest'
```
```
- Fix checking `preactjs/compressed-size-action@v2` usage caused a false positive. ([#​422](https://github.com/rhysd/actionlint/issues/422))
- Fix an error message when invalid escaping is found in globs.
- The design of the [playground page](https://rhysd.github.io/actionlint/) is overhauled following the upgrade of bulma package to v1.
- Current actionlint version is shown in the heading.
- The color theme is changed to the official dark theme.
- The list of useful links is added to the bottom of the page as 'Resources' section.
[Changes][v1.7.1]
<a id="v1.7.0"></a>
```
### [`v1.7.0`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v170---2024-05-08)
[Compare Source](https://github.com/rhysd/actionlint/compare/v1.6.27...v1.7.0)
- From this version, actionlint starts to check action metadata file `action.yml` (or `action.yaml`). At this point, only very basic checks are implemented and contents of `steps:` are not checked yet.
- It checks properties under `runs:` section (e.g. `main:` can be specified when it is a JavaScript action), `branding:` properties, and so on.
```yaml
name: 'My action'
author: '...'
```
### ERROR: 'description' section is missing
```
branding:
```
### ERROR: Invalid icon name
```
icon: dog
runs:
```
### ERROR: Node.js runtime version is too old
```
using: 'node12'
```
### ERROR: The source file being run by this action does not exist
```
main: 'this-file-does-not-exist.js'
```
### ERROR: 'env' configuration is only allowed for Docker actions
````
env:
SOME_VAR: SOME_VALUE
```
````
- actionlint still focuses on checking workflow files. So there is no way to directly specify `action.yml` as an argument of `actionlint` command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead.
- Checks for `steps:` contents are planned to be implemented. Since several differences are expected between `steps:` in workflow file and `steps:` in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected.
- Add `runner.environment` property. ([#​412](https://github.com/rhysd/actionlint/issues/412))
```yaml
- run: echo 'Run by GitHub-hosted runner'
if: runner.environment == 'github-hosted'
```
- Using outdated popular actions is now detected at error. See [the document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#detect-outdated-popular-actions) for more details.
- Here 'outdated' means actions which use runtimes no longer supported by GitHub-hosted runners such as `node12`.
```yaml
```
### ERROR: actions/checkout@v2 is using the outdated runner 'node12'
````
- uses: actions/checkout@v2
```
````
- Support `attestations` permission which was [recently added to GitHub Actions as beta](https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds). ([#​418](https://github.com/rhysd/actionlint/issues/418), thanks [@​bdehamer](https://github.com/bdehamer))
```yaml
permissions:
id-token: write
contents: read
attestations: write
```
- Check comparison expressions more strictly. Arbitrary types of operands can be compared as [the official document](https://docs.github.com/en/actions/learn-github-actions/expressions#operators) explains. However, comparisons between some types are actually meaningless because the values are converted to numbers implicitly. actionlint catches such meaningless comparisons as errors. Please see [the check document](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-comparison-types) for more details.
```yaml
on:
workflow_call:
inputs:
timeout:
type: boolean
jobs:
test:
runs-on: ubuntu-latest
steps:
- run: echo 'called!'
```
### ERROR: Comparing string to object is always evaluated to false
```
if: ${{ github.event == 'workflow_call' }}
- run: echo 'timeout is too long'
```
### ERROR: Comparing boolean value with `>` doesn't make sense
```
if: ${{ inputs.timeout > 60 }}
```
````
- Follow the update that `macos-latest` is now an alias to `macos-14` runner.
- Support a custom python shell by `pyflakes` rule.
- Add workaround actionlint reports that `dorny/paths-filter`'s `predicate-quantifier` input is not defined. ([#​416](https://github.com/rhysd/actionlint/issues/416))
- Fix the type of a conditional expression by comparison operators is wider than expected by implementing type narrowing. ([#​384](https://github.com/rhysd/actionlint/issues/384))
- For example, the type of following expression should be `number` but it was actually `string | number` and actionlint complained that `timeout-minutes` must take a number value.
```yaml
timeout-minutes: ${{ env.FOO && 10 || 60 }}
```
- Fix `${{ }}` placeholder is not available at `jobs.<job_id>.services`. ([#​402](https://github.com/rhysd/actionlint/issues/402))
```yaml
jobs:
test:
services: ${{ fromJSON('...') }}
runs-on: ubuntu-latest
steps:
- run: ...
````
- Do not check outputs of `google-github-actions/get-secretmanager-secrets` because this action sets outputs dynamically. ([#​404](https://github.com/rhysd/actionlint/issues/404))
- Fix `defaults.run` is ignored on detecting the shell used in `run:`. ([#​409](https://github.com/rhysd/actionlint/issues/409))
```yaml
defaults:
run:
shell: pwsh
jobs:
test:
runs-on: ubuntu-latest
steps:
```
### This was wrongly detected as bash script
```
- run: $Env:FOO = "FOO"
```
````
- Fix parsing a syntax error reported from pyflakes when checking a Python script in `run:`. ([#​411](https://github.com/rhysd/actionlint/issues/411))
```yaml
- run: print(
shell: python
````
- Skip checking `exclude:` items in `matrix:` when they are constructed from `${{ }}` dynamically. ([#​414](https://github.com/rhysd/actionlint/issues/414))
```yaml
matrix:
foo: ['a', 'b']
exclude:
```
### actionlint complained this value didn't exist in matrix combinations
```
- foo: ${{ env.EXCLUDE_FOO }}
```
````
- Fix checking `exclude:` items when `${{ }}` is used in nested arrays at matrix items.
```yaml
matrix:
foo:
- ["${{ fromJSON('...') }}"]
exclude:
### actionlint complained this value didn't match to any matrix combinations
- foo: ['foo']
````
- Update popular actions data set. New major versions are added and the following actions are newly added.
- `peaceiris/actions-hugo`
- `actions/attest-build-provenance`
- `actions/add-to-project`
- `octokit/graphql-action`
- Update Go dependencies to the latest.
- Reduce the size of `actionlint` executable by removing redundant data from popular actions data set.
- x86\_64 executable binary size was reduced from 6.9MB to 6.7MB (2.9% smaller).
- Wasm binary size was reduced from 9.4MB to 8.9MB (5.3% smaller).
- Describe how to [integrate actionlint to Pulsar Edit](https://web.pulsar-edit.dev/packages/linter-github-actions) in [the document](https://github.com/rhysd/actionlint/blob/main/docs/usage.md#pulsar-edit). ([#​408](https://github.com/rhysd/actionlint/issues/408), thanks [@​mschuchard](https://github.com/mschuchard))
- Update outdated action versions in the usage document. ([#​413](https://github.com/rhysd/actionlint/issues/413), thanks [@​naglis](https://github.com/naglis))
\[Changes]\[v1.7.0]
<a id="v1.6.27"></a>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40My41IiwidXBkYXRlZEluVmVyIjoiNDEuNDMuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/791
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2025-08-02 17:56:34 +00:00
|
|
|
github.com/rhysd/actionlint v1.7.7 h1:0KgkoNTrYY7vmOCs9BW2AHxLvvpoY9nEUzgBHiPUr0k=
|
|
|
|
|
github.com/rhysd/actionlint v1.7.7/go.mod h1:AE6I6vJEkNaIfWqC2GNE5spIJNhxf8NCtLEKU4NnUXg=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
|
2024-08-23 10:54:10 +00:00
|
|
|
github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
|
|
|
|
|
github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
|
2023-11-07 20:19:08 +01:00
|
|
|
github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
|
|
|
|
|
github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
|
2025-08-02 23:00:47 +00:00
|
|
|
github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
|
|
|
|
|
github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
|
2025-01-10 11:01:56 +00:00
|
|
|
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
|
|
|
|
|
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
|
2023-08-02 04:34:36 +00:00
|
|
|
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
|
|
|
|
|
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
|
2025-08-02 23:00:47 +00:00
|
|
|
github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
|
|
|
|
|
github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
|
2025-05-02 21:53:20 +00:00
|
|
|
github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
|
|
|
|
|
github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
|
|
|
|
|
github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
|
2025-08-02 18:51:59 +00:00
|
|
|
github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
|
|
|
|
|
github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
2025-01-10 11:01:56 +00:00
|
|
|
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
|
|
|
|
|
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
|
2024-08-13 13:23:35 +00:00
|
|
|
github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
|
|
|
|
|
github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
|
|
|
|
|
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
|
|
|
|
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
|
|
|
|
|
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
2025-01-10 11:01:56 +00:00
|
|
|
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
|
|
|
|
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
|
|
|
|
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
|
2024-11-24 00:02:30 +00:00
|
|
|
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
|
|
|
|
|
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
|
2025-01-10 11:01:56 +00:00
|
|
|
github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928 h1:zjNCuOOhh1TKRU0Ru3PPPJt80z7eReswCao91gBLk00=
|
|
|
|
|
github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928/go.mod h1:PCFYfAEfKT+Nd6zWvUpsXduMR1bXFLf0uGSlEF05MCI=
|
2023-05-04 18:45:01 +08:00
|
|
|
github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
|
|
|
|
|
github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
|
2023-08-10 01:45:25 +00:00
|
|
|
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
|
|
|
|
|
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
|
2022-11-22 15:34:13 +08:00
|
|
|
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
|
2023-03-17 09:45:46 +08:00
|
|
|
github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
|
|
|
|
|
github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
|
2022-04-27 17:45:53 +08:00
|
|
|
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
|
|
|
|
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
2025-01-10 11:01:56 +00:00
|
|
|
go.etcd.io/bbolt v1.3.8/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw=
|
2025-08-02 17:58:33 +00:00
|
|
|
go.etcd.io/bbolt v1.4.2 h1:IrUHp260R8c+zYx/Tm8QZr04CX+qWS5PGfPdevhdm1I=
|
|
|
|
|
go.etcd.io/bbolt v1.4.2/go.mod h1:Is8rSHO/b4f3XigBC0lL0+4FwAQv3HXEEIgFMuKHceM=
|
2025-01-10 11:01:56 +00:00
|
|
|
go.etcd.io/gofail v0.1.0/go.mod h1:VZBCXYGZhHAinaBiiqYvuDynvahNsAyLFwB3kEHKz1M=
|
2025-06-14 14:54:20 +00:00
|
|
|
go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
|
|
|
|
|
go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
|
2024-08-23 10:54:10 +00:00
|
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 h1:aFJWCqJMNjENlcleuuOkGAPH82y0yULBScfXcIEdS24=
|
|
|
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1/go.mod h1:sEGXWArGqc3tVa+ekntsN65DmVbVeW+7lTKTjZF3/Fo=
|
2025-06-14 14:54:20 +00:00
|
|
|
go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
|
|
|
|
|
go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
|
2024-08-23 10:54:10 +00:00
|
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 h1:cl5P5/GIfFh4t6xyruOgJP5QiA1pw4fYYdv6nc6CBWw=
|
|
|
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0/go.mod h1:zgBdWWAu7oEEMC06MMKc5NLbA/1YDXV1sMpSqEeLQLg=
|
|
|
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 h1:digkEZCJWobwBqMwC0cwCq8/wkkRy/OowZg5OArWZrM=
|
|
|
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0/go.mod h1:/OpE/y70qVkndM0TrxT4KBoN3RsFZP0QaofcfYrj76I=
|
2025-06-14 14:54:20 +00:00
|
|
|
go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
|
|
|
|
|
go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
|
2024-08-23 10:54:10 +00:00
|
|
|
go.opentelemetry.io/otel/sdk v1.21.0 h1:FTt8qirL1EysG6sTQRZ5TokkU8d0ugCj8htOgThZXQ8=
|
|
|
|
|
go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
|
2025-06-14 14:54:20 +00:00
|
|
|
go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
|
|
|
|
|
go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
|
2024-08-23 10:54:10 +00:00
|
|
|
go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
|
|
|
|
|
go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
|
2022-04-27 17:45:53 +08:00
|
|
|
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
|
|
|
|
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
|
|
|
|
|
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
2023-05-04 18:45:01 +08:00
|
|
|
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
|
2025-08-02 23:00:47 +00:00
|
|
|
golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
|
|
|
|
|
golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
|
2025-01-10 11:01:56 +00:00
|
|
|
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
|
|
|
|
|
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
|
2022-04-27 17:45:53 +08:00
|
|
|
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
|
|
|
|
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
|
|
|
|
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
|
|
|
|
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
|
|
|
|
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
|
|
|
|
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
|
2023-05-04 18:45:01 +08:00
|
|
|
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
2025-08-02 23:00:47 +00:00
|
|
|
golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
|
|
|
|
|
golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
|
2022-04-27 17:45:53 +08:00
|
|
|
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
|
|
|
|
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
|
|
|
|
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
2025-05-14 08:16:27 +00:00
|
|
|
golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
|
|
|
|
|
golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
|
2022-04-27 17:45:53 +08:00
|
|
|
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
|
|
|
|
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
|
|
|
|
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
|
|
|
|
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
|
|
|
|
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
|
|
|
|
golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
2023-05-04 18:45:01 +08:00
|
|
|
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
2022-04-27 17:45:53 +08:00
|
|
|
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
2023-08-10 01:45:25 +00:00
|
|
|
golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
2022-08-12 14:59:58 +08:00
|
|
|
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
2025-01-10 11:01:56 +00:00
|
|
|
golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
2023-03-17 09:45:46 +08:00
|
|
|
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
2025-01-10 11:01:56 +00:00
|
|
|
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
2025-08-10 20:16:40 +00:00
|
|
|
golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
|
|
|
|
|
golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
|
2022-04-27 17:45:53 +08:00
|
|
|
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
2025-08-10 20:16:40 +00:00
|
|
|
golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
|
|
|
|
|
golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
|
2022-04-27 17:45:53 +08:00
|
|
|
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
|
|
|
|
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
|
|
|
|
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
2025-08-02 23:00:47 +00:00
|
|
|
golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
|
|
|
|
|
golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
|
2025-06-07 09:07:52 +00:00
|
|
|
golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
|
|
|
|
|
golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
|
2022-04-27 17:45:53 +08:00
|
|
|
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
|
|
|
|
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
|
|
|
|
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
|
|
|
|
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
|
|
|
|
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
|
|
|
|
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
|
|
|
|
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
|
|
|
|
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
2025-07-28 18:45:02 +02:00
|
|
|
google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 h1:wpZ8pe2x1Q3f2KyT5f8oP/fa9rHAKgFPr/HZdNuS+PQ=
|
2025-05-14 08:16:27 +00:00
|
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f h1:2yNACc1O40tTnrsbk9Cv6oxiW8pxI/pXj0wRtdlYmgY=
|
|
|
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f/go.mod h1:Uy9bTZJqmfrw2rIBxgGLnamc78euZULUBrLZ9XTITKI=
|
2025-06-14 14:54:20 +00:00
|
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 h1:pPJltXNxVzT4pK9yD8vR9X75DaWYYmLGMsEvBfFQZzQ=
|
|
|
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU=
|
|
|
|
|
google.golang.org/grpc v1.67.0 h1:IdH9y6PF5MPSdAntIcpjQ+tXO41pcQsfZV2RxtQgVcw=
|
|
|
|
|
google.golang.org/grpc v1.67.0/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
|
2025-08-10 13:43:45 +00:00
|
|
|
google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
|
|
|
|
|
google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
|
2022-04-27 17:45:53 +08:00
|
|
|
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
|
|
|
|
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
|
|
|
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
|
|
|
|
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
|
|
|
|
|
gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
|
|
|
|
|
gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
|
|
|
|
|
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
|
|
|
|
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
|
|
|
|
|
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
2022-08-12 14:59:58 +08:00
|
|
|
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
|
|
|
|
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
2025-05-02 13:48:30 +00:00
|
|
|
gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
|
|
|
|
|
gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
|
