Skip to content

chore(ci): switch to jactionlint v2 #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jdx merged 4 commits into from
Oct 10, 2026
Merged

chore(ci): switch to jactionlint v2 #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a39a553
chore(ci): switch to jactionlint v2
jdx Oct 9, 2026
45dff9a
fix(ci): pin jactionlint 2.0.2 exactly instead of overriding minimum_…
jdx Oct 10, 2026
bf2d288
chore(ci): bump jactionlint to 2.1.0 and run its online checks in CI
jdx Oct 10, 2026
1eafe53
chore(ci): track latest jactionlint, locked at 2.1.0
jdx Oct 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,10 @@ on:
permissions:
contents: read

concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true

jobs:
lint:
runs-on: ubuntu-latest
Expand All @@ -18,3 +22,7 @@ jobs:
persist-credentials: false
- uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
- run: mise x hk -- hk check --all
env:
# jactionlint's online checks (known-vulnerable actions, impostor commits, stale refs) run in CI only.
JACTIONLINT_ONLINE: 1
GITHUB_TOKEN: ${{ github.token }}

@cursor cursor Bot Oct 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI online checks never run

Medium Severity

jactionlint turns on network checks with --online, not JACTIONLINT_ONLINE. The hk step still runs jactionlint without that flag, so known-vulnerable-action, impostor-commit, and stale-ref checks stay off in CI even though GITHUB_TOKEN is set.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 1eafe53. Configure here.

@jdx jdx Oct 10, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

JACTIONLINT_ONLINE is a documented setting in jactionlint 2.1.0 (added in jdx/jactionlint#155; see "Online checks" in https://github.com/jdx/jactionlint/blob/main/docs/usage.md). It acts like --online (1 = on, cache/strict/cache,strict = modes, 0/false/off/no = off like --no-online); the flags beat the variable and the variable beats online: in the config file. jactionlint --help lists it under --online, and this repo's mise.lock installs 2.1.0.

I checked with the real binary: JACTIONLINT_ONLINE=1 GITHUB_TOKEN=... jactionlint --verbose <workflow> prints online: using the token from $GITHUB_TOKEN for api.github.com. hk runs the command with the step's environment, so setting it on the hk step enables the online audits without --online in hk.pkl, which is intentional: local pre-commit runs stay offline. No change needed.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: claude-code_2-1-293_agent.

13 changes: 10 additions & 3 deletions hk.pkl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
amends "package://github.com/jdx/hk/releases/download/v1.18.1/hk@1.18.1#/Config.pkl"
import "package://github.com/jdx/hk/releases/download/v1.18.1/hk@1.18.1#/Builtins.pkl"
amends "package://github.com/jdx/hk/releases/download/v2.5.0/hk@2.5.0#/Config.pkl"
import "package://github.com/jdx/hk/releases/download/v2.5.0/hk@2.5.0#/Builtins.pkl"

local linters = new Mapping<String, Step> {
["lua-check"] {
Expand All @@ -15,7 +15,14 @@ local linters = new Mapping<String, Step> {
["jactionlint"] {
glob = List(".github/workflows/*.yml", ".github/workflows/*.yaml")
batch = true
check = "jactionlint {{files}}"
check = new CommandSpec {
command = "jactionlint {{ files }}"
effect = "read"
}
fix = new CommandSpec {
command = "jactionlint --fix {{ files }}"
effect = "write"
}
}
}

Expand Down
44 changes: 22 additions & 22 deletions mise.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading