add actionlint to check github actions by witoszekdev · Pull Request #6337 · saleor/saleor-dashboard

witoszekdev · 2026-02-12T19:20:12Z

Added static checker for Github Actions definitions: https://github.com/rhysd/actionlint

changeset-bot · 2026-02-12T19:20:17Z

🦋 Changeset detected

Latest commit: 4f49571

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-02-12T19:23:42Z

Differences Found

✅ No packages or licenses were added.

Summary

Expand

License Name	Package Count	Packages
0BSD	1	Packages tslib
CC0-1.0	1	Packages type-fest
MIT/X11	1	Packages nub
MPL-1.1	1	Packages harmony-reflect
MPL-2.0	1	Packages dompurify
Public Domain	1	Packages jsonify
Python-2.0	1	Packages argparse
WTFPL	1	Packages utf8-byte-length
CC-BY-4.0	2	Packages @saleor/macaw-ui caniuse-lite
SEE LICENSE IN LICENSE	2	Packages posthog-js spawndamnit
BlueOak-1.0.0	7	Packages @isaacs/cliui glob jackspeak lru-cache minimatch package-json-from-dist path-scurry
<<missing>>	11	Packages @sentry/cli @sentry/cli-darwin @sentry/cli-linux-arm @sentry/cli-linux-arm64 @sentry/cli-linux-i686 @sentry/cli-linux-x64 @sentry/cli-win32-arm64 @sentry/cli-win32-i686 @sentry/cli-win32-x64 busboy streamsearch
BSD-2-Clause	23	Packages browser-process-hrtime css-select css-what domelementtype domhandler domutils dotenv dotenv-expand entities escodegen eslint-scope espree esprima esrecurse estraverse esutils nth-check regjsparser stringify-object terser And 3 more...
ISC	48	Packages @istanbuljs/load-nyc-config anymatch boolbase cli-width cliui electron-to-chromium fastq flatted foreground-child fs.realpath get-caller-file get-own-enumerable-property-symbols glob glob-parent graceful-fs inflight inherits ini isexe knip And 28 more...
BSD-3-Clause	52	Packages @protobufjs/aspromise @protobufjs/base64 @protobufjs/codegen @protobufjs/eventemitter @protobufjs/fetch @protobufjs/float @protobufjs/inquire @protobufjs/path @protobufjs/pool @protobufjs/utf8 @saleor/app-sdk @sentry/cli @sentry/cli-darwin @sentry/cli-linux-arm @sentry/cli-linux-arm64 @sentry/cli-linux-i686 @sentry/cli-linux-x64 @sentry/cli-win32-i686 @sentry/cli-win32-x64 @sinonjs/commons And 32 more...
Apache-2.0	64	Packages @editorjs/editorjs @eslint/config-array @eslint/config-helpers @eslint/core @eslint/object-schema @eslint/plugin-kit @humanfs/core @humanfs/node @humanwhocodes/module-importer @humanwhocodes/retry @opentelemetry/api @opentelemetry/api-logs @opentelemetry/core @opentelemetry/exporter-logs-otlp-http @opentelemetry/otlp-exporter-base @opentelemetry/otlp-transformer @opentelemetry/resources @opentelemetry/sdk-logs @opentelemetry/sdk-metrics @opentelemetry/sdk-trace-base And 44 more...
MIT	1305	Packages @adobe/css-tools @apollo/client @ardatan/relay-compiler @ardatan/sync-fetch @babel/code-frame @babel/compat-data @babel/core @babel/generator @babel/helper-annotate-as-pure @babel/helper-compilation-targets @babel/helper-create-class-features-plugin @babel/helper-globals @babel/helper-member-expression-to-functions @babel/helper-module-imports @babel/helper-module-transforms @babel/helper-optimise-call-expression @babel/helper-plugin-utils @babel/helper-replace-supers @babel/helper-skip-transparent-expression-wrappers @babel/helper-string-parser And 1285 more...

codecov · 2026-02-12T19:24:13Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 42.76%. Comparing base (b294c2a) to head (4f49571).

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #6337    +/-   ##
========================================
  Coverage   42.76%   42.76%            
========================================
  Files        2507     2507            
  Lines       43508    43508            
  Branches     9894    10277   +383     
========================================
  Hits        18607    18607            
  Misses      24863    24863            
  Partials       38       38

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

NyanKiyoshi

Just use pre-commit instead? It removes all the need for custom installation scripts, checking hashes (--freeze), etc.

The actionlint-docker hook is the preferable one

We are re-inventing the wheel 😅

witoszekdev · 2026-02-13T14:47:05Z

@NyanKiyoshi I know it's in pre-commit but... we also have TypeScript in pre-commit, and yet we also run it in CI to make sure code actually passes the test (after all you can use --no-verify 😄)

For now I marked it as optional (|| true) because we have linter issue to resolve, but ideally it should block merging a PR.

I can migrate it to Docker, but that would be a spearate step - we already use pnpm run lint which runs all linters in parallel (via special regex syntax which looks for all lint: scripts) so this approach should be faster imho

NyanKiyoshi · 2026-02-13T15:06:36Z

scripts/install-actionlint.bash

+file="actionlint_${VERSION}_${os}_${arch}.${ext}"
+url="https://github.com/rhysd/actionlint/releases/download/v${VERSION}/${file}"


Could we at least use the checksums to ensure the release doesn't mutate as they don't use immutable releases?

The checksums (they need to be stored raw in our repo in this file or file next to it):

16782c41f2af264db80f855ee5d09164ca98fc78edf3bcd0f46eecff279682ba actionlint_1.7.10_darwin_amd64.tar.gz 004ca87b367b37f4d75c55ab6cf80f9b8c043adbfbd440f31c604d417939c442 actionlint_1.7.10_darwin_arm64.tar.gz 31ec5ee4deef04edf3b9eb3bac5243d785b5dccf70688e02a022b0723bfae80a actionlint_1.7.10_freebsd_386.tar.gz 418461873e1f8eb7acc7524d70d4c33e99f9aab53da8625f4a3c50273612c930 actionlint_1.7.10_freebsd_amd64.tar.gz b728a3c31f7bd37d3026a7cd87148da9ddf845b5d56213fcc410bb222523c7d0 actionlint_1.7.10_linux_386.tar.gz f4c76b71db5755a713e6055cbb0857ed07e103e028bda117817660ebadb4386f actionlint_1.7.10_linux_amd64.tar.gz cd3dfe5f66887ec6b987752d8d9614e59fd22f39415c5ad9f28374623f41773a actionlint_1.7.10_linux_arm64.tar.gz 7624bae3f6e41985f498de7b246a2334cd734b9f1a8f04a9748429cbcf99b750 actionlint_1.7.10_linux_armv6.tar.gz 1783f8a1dd59a67dae373e753a88592351e00128195bc9ddd2b836a0c31df71b actionlint_1.7.10_windows_386.zip 283467f9d6202a8cb8c00ad8dd0ee4e685b71fb86a6a56c68fcbb9ae8ed91237 actionlint_1.7.10_windows_amd64.zip 0c7242bca2f0ee4672a00ce7fa3c7185311fb94cb9e1e0f6bb57d5456e421d80 actionlint_1.7.10_windows_arm64.zip

You can grep the correct line based on the file name that you generate (e.g., actionlint_1.7.10_windows_amd64.zip), then do sha256sum -c -

For example, let's say we have checksums.txt stored them, then we can do this:

( # (sub-shell as we do 'cd') cd "$tmpdir" if ! (grep -E "${file}\$" checksums.txt | sha256sum -c -); then echo "Downloaded file doesn't matched expected checksum. Aborting..." >&2 exit 1 fi )

(assumes that the filename isn't changed, you could alter curl command with -o "$file" to make it consistent, it makes it a bit simpler as otherwise we would need intermediary variables)

NyanKiyoshi · 2026-02-13T15:07:44Z

scripts/install-actionlint.bash

+
+if [ "$os" = "windows" ]; then
+  tmpdir="$(mktemp -d)"
+  curl -sSL -o "$tmpdir/tmp.zip" "$url"


Missing the --fail flag (to fail on HTTP ≥ 400)

Suggested change

curl -sSL -o "$tmpdir/tmp.zip" "$url"

curl -fsSL -o "$tmpdir/tmp.zip" "$url"

NyanKiyoshi · 2026-02-13T15:07:51Z

scripts/install-actionlint.bash

+  unzip -o "$tmpdir/tmp.zip" actionlint.exe -d "$TARGET_DIR"
+  rm -rf "$tmpdir"
+else
+  curl -sSL "$url" | tar xz -C "$TARGET_DIR" actionlint


Suggested change

curl -sSL "$url" | tar xz -C "$TARGET_DIR" actionlint

curl -fsSL "$url" | tar xz -C "$TARGET_DIR" actionlint

add actionlint to check github actions

88698db

witoszekdev requested a review from a team as a code owner February 12, 2026 19:20

witoszekdev requested a review from lkostrowski February 12, 2026 19:20

witoszekdev added 4 commits February 13, 2026 13:05

fix workflow failing

66ebf59

fix actionlint failing lint command, remove separate actionlint step

cbad358

add changeset

f7d5c33

Merge branch 'main' into add-actionlint

4f49571

lkostrowski requested a review from NyanKiyoshi February 13, 2026 14:38

NyanKiyoshi requested changes Feb 13, 2026

View reviewed changes

NyanKiyoshi reviewed Feb 13, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

add actionlint to check github actions#6337

add actionlint to check github actions#6337
witoszekdev wants to merge 5 commits intomainfrom
add-actionlint

witoszekdev commented Feb 12, 2026 •

edited

Loading

Uh oh!

changeset-bot bot commented Feb 12, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

codecov bot commented Feb 12, 2026 •

edited

Loading

Uh oh!

NyanKiyoshi left a comment

Uh oh!

witoszekdev commented Feb 13, 2026 •

edited

Loading

Uh oh!

NyanKiyoshi Feb 13, 2026 •

edited

Loading

Uh oh!

NyanKiyoshi Feb 13, 2026

Uh oh!

NyanKiyoshi Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		file="actionlint_${VERSION}_${os}_${arch}.${ext}"
		url="https://github.com/rhysd/actionlint/releases/download/v${VERSION}/${file}"

	curl -sSL -o "$tmpdir/tmp.zip" "$url"
	curl -fsSL -o "$tmpdir/tmp.zip" "$url"

	curl -sSL "$url" \| tar xz -C "$TARGET_DIR" actionlint
	curl -fsSL "$url" \| tar xz -C "$TARGET_DIR" actionlint

Comments

Conversation

witoszekdev commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions bot commented Feb 12, 2026

Differences Found

Summary

Uh oh!

codecov bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

NyanKiyoshi left a comment

Choose a reason for hiding this comment

Uh oh!

witoszekdev commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NyanKiyoshi Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NyanKiyoshi Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

NyanKiyoshi Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

witoszekdev commented Feb 12, 2026 •

edited

Loading

changeset-bot bot commented Feb 12, 2026 •

edited

Loading

codecov bot commented Feb 12, 2026 •

edited

Loading

witoszekdev commented Feb 13, 2026 •

edited

Loading

NyanKiyoshi Feb 13, 2026 •

edited

Loading