actionlint

Tests would have caught it = https://github.com/rhysd/actionlint injection check

Not too long ago, I went down a rabbit hole of specifying GHA yaml via dhall, and quickly hit some problems; the specific thing I was starting with was the part I was frustrated with, which was the "expresssions" evaluation stuff. However, I quickly ran into the whole "no recursive data structures in dhall" (at least, not how you would normally think about it), and of course, a standard representation of expressions is a recursively defined data type. I do get why dhall did this, but it did mean that I quickly ran into super advanced stuff, and realized that I couldn't in good conscience use this as my team of mixed engineers would need to read/maintain it in the future, without any knowledge of how to do recursive definitions in dhall, and without the inclination to care either. an intro to this: https://docs.dhall-lang.org/howtos/How-t

Yep, actionlint is great! I've used it successfully both to lint my own workflows, and to lint third-party workflows for (basic) security issues. Unfortunately, it can't lint actions themselves, only workflows that call actions[1]. This is a substantial deficiency, especially for users (like me) who write and maintain a decent number of actions. [1]: https://github.com/rhysd/actionlint/issues/46

A linter can catch some obvious errors: https://github.com/rhysd/actionlint. But yes, I agree, it's not a fun debugging experience.

The first pitfall can be statically detected with actionlint https://github.com/rhysd/actionlint > oops.yaml:20:24: property "jobone" is not defined in object type {jobtwo: {outputs: {}; result: string}} [expression]