v0.2.9

Pull Requests | Issues | v0.2.8...v0.2.9

Features

#281 Add a policy action_shell_is_required

v0.2.8

Pull Requests | Issues | v0.2.7...v0.2.8

Features

#275 #280 Support validating action.ya?ml

Others

#279 Refactoring

v0.2.7

Pull Requests | Issues | v0.2.6...v0.2.7

Features

#252 Add a global option -log-color
#203 #253 support changing log level
#254 Add links to document to error logs
#255 Add a global option -config (-c)
#256 add a new policy github_app_should_limit_repositories
#257 add a new policy github_app_should_limit_permissions

v0.2.6

Pull Requests | Issues | v0.2.5...v0.2.6

Features

#244 Add links to policy document to logs

e.g.

ERRO[0000] action ref should be full length SHA1         document="https://github.com/suzuki-shunsuke/ghalint/blob/main/docs/policies/008.md" job_name=release policy_name=action_ref_should_be_full_length_commit_sha program=ghalint uses=suzuki-shunsuke/go-release-workflow/.github/workflows/release.yaml@v0.4.5 version= workflow_file_path=.github/workflows/release.yaml

document="https://github.com/suzuki-shunsuke/ghalint/blob/main/docs/policies/008.md"

v0.2.5

Pull Requests | Issues | v0.2.4...v0.2.5

Bug Fixes

#240 #241 output errors regarding to configuration files

v0.2.4

Pull Requests | Issues | v0.2.3...v0.2.4

Bug Fixes

#235 #236 Fix a bug that ghalint couldn't parse workflow files if container is a string

container: "composer:2.6.5"

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idcontainer

When you only specify a container image, you can omit the image keyword.

ghalint should support the format too.

v0.2.3

Pull Requests | Issues | v0.2.2...v0.2.3

Features

Add new policies

#209 #214 secrets: inherit should not be used
#208 #217 docker image tag should not be latest
#206 #218 action version should be commit hashes

Others

#226 Refactor package structure
#224 #225 #227 Add unit tests
#228 Support Scoop

You can install ghalint with Scoop

scoop bucket add suzuki-shunsuke https://github.com/suzuki-shunsuke/scoop-bucket
scoop install ghalint

v0.2.3-1

Pull Requests | Issues | v0.2.2...v0.2.3-1

Changelog

• 77aa289 docs: feature pinact
• 81c33b7 test: add tests (#227)
• ef100db Refactor package structure (#226)
• e19ed22 test: add tests (#225)
• 029c125 test: add tests (#224)
• d87f340 chore: renovate nolimit (#223)
• ab14c68 chore(deps): update actions/checkout action to v4 (#221)
• a26253e chore(deps): update tibdex/github-app-token action to v2 (#222)
• 3e59a45 chore(deps): update tibdex/github-app-token action to v1.9.0
• 83c889f chore(deps): update actions/checkout action to v3.6.0
• 8dd4f0b feat: add a policy action_ref_should_be_sha1 (#218)
• 30d9d9c feat: add a policy deny_job_container_latest_image (#217)
• a2bfca1 docs: separate documents about policies (#216)
• 04b99d4 refactor: shorten receiver names (#215)
• 64672f0 feat: add a policy deny_inherit_secrets (#214)
• 4d24dfe chore(deps): update dependency aquaproj/aqua-renovate-config to v1.12.0
• a779084 chore(deps): update dependency golang/go to v1.21.4
• 187f8c9 Merge pull request #96 from suzuki-shunsuke/renovate/suzuki-shunsuke-renovate-config-2.x
• 1d01432 chore(deps): update dependency suzuki-shunsuke/renovate-config to v2.2.0
• 26a9acb chore: add cmdx.yaml (#201)
• 03575f8 chore(deps): update dependency suzuki-shunsuke/renovate-config:action-go-version to v2.2.0
• 9491f48 chore(deps): update dependency golang/go to v1.21.3
• 65ed60e chore: remove aqua-poilcy.yaml (#198)
• 8005a2b chore(deps): update aquaproj/update-checksum-workflow action to v0.1.8
• 9d336a9 chore(deps): update suzuki-shunsuke/go-release-workflow action to v0.4.4
• 4e50621 chore(deps): update dependency aquaproj/aqua-renovate-config to v1.11.0
• 86fde80 chore(deps): update dependency rhysd/actionlint to v1.6.26
• f25de89 chore(deps): update dependency aquaproj/aqua-renovate-config to v1.10.0
• dce3498 chore(deps): update dependency aquaproj/aqua-renovate-config to v1.9.0
• c450748 chore(deps): update dependency reviewdog/reviewdog to v0.15.0
• 36033fc chore(deps): update suzuki-shunsuke/go-release-workflow action to v0.4.3
• 97f8cc5 chore(deps): update dependency goreleaser/goreleaser to v1.20.0
• ff796a8 chore(deps): update dependency aquaproj/aqua-renovate-config to v1.8.0
• 026ec89 chore(deps): update dependency suzuki-shunsuke/cmdx to v1.7.3
• beeab6d chore(deps): update dependency aquaproj/aqua-renovate-config to v1.7.0
• 9d78dc3 chore(deps): update dependency aquaproj/aqua to v2.9.1
• 3d2b3dc chore(deps): update suzuki-shunsuke/renovate-config-validator-workflow action to v0.2.2
• 42af8e7 chore(deps): update dependency aquaproj/aqua-registry to v4.26.0
• ce96f25 Merge pull request #177 from suzuki-shunsuke/renovate/suzuki-shunsuke-renovate-config-validator-workflow-0.x
• b577215 chore(deps): update suzuki-shunsuke/renovate-config-validator-workflow action to v0.2.1
• 6c49c1d Merge pull request #176 from suzuki-shunsuke/renovate/goreleaser-goreleaser-1.x
• 1750f8c chore(aqua): update aqua-checksums.json
• 4758610 chore(deps): update dependency goreleaser/goreleaser to v1.19.2
• a6e0ea6 Merge pull request #175 from suzuki-shunsuke/renovate/aquaproj-aqua-registry-4.x
• 9365fa6 chore(aqua): update aqua-checksums.json
• 8c9deb8 chore(deps): update dependency aquaproj/aqua-registry to v4.25.0
• 3bc473f Merge pull request #174 from suzuki-shunsuke/renovate/aquaproj-aqua-registry-4.x
• 5e2ebdb chore(aqua): update aqua-checksums.json
• a081466 chore(deps): update dependency aquaproj/aqua-registry to v4.24.0
• 6310638 Merge pull request #173 from suzuki-shunsuke/renovate/goreleaser-goreleaser-1.x
• a415ade chore(aqua): update aqua-checksums.json
• 15d6f33 chore(deps): update dependency goreleaser/goreleaser to v1.19.1
• 6d340ab Merge pull request #172 from suzuki-shunsuke/renovate/goreleaser-goreleaser-1.x
• cc1a062 chore(aqua): update aqua-checksums.json
• d87a631 chore(deps): update dependency goreleaser/goreleaser to v1.19.0
• c2edc67 Merge pull request #171 from suzuki-shunsuke/renovate/aquaproj-aqua-registry-4.x
• 7c4e441 chore(aqua): update aqua-checksums.json
• 8d357d5 chore(deps): update dependency aquaproj/aqua-registry to v4.23.0
• d68fb70 Merge pull request #170 from suzuki-shunsuke/renovate/aquaproj-aqua-registry-4.x
• 9b7c55f chore(aqua): update aqua-checksums.json
• da6b597 chore(deps): update dependency aquaproj/aqua-registry to v4.22.0
• d408f12 chore(deps): update dependency aquaproj/aqua-registry to v4 (#146)
• fd7e8a4 Merge pull request #169 from suzuki-shunsuke/renovate/aquaproj-update-checksum-workflow-0.x
• 9ca3418 chore(deps): update aquaproj/update-checksum-workflow action to v0.1.7
• 55e0520 Merge pull request #168 from suzuki-shunsuke/renovate/reviewdog-reviewdog-0.x
• 0613885 chore(aqua): update aqua-checksums.json
• 00de4bd chore(deps): update dependency reviewdog/reviewdog to v0.14.2
• 31ceeaf Merge pull request #167 from suzuki-shunsuke/renovate/github.com-urfave-cli-v2-2.x
• 65592e6 fix(deps): update module github.com/urfave/cli/v2 to v2.25.7
• 0c14038 Merge pull request #166 from suzuki-shunsuke/renovate/aquaproj-aqua-2.x
• 9df7ff5 chore(deps): update dependency aquaproj/aqua to v2.9.0
• 831c4d4 Merge pull request #165 from suzuki-shunsuke/renovate/rhysd-actionlint-1.x
• 44e69c1 chore(aqua): update aqua-checksums.json
• dd4c4ed chore(deps): update dependency rhysd/actionlint to v1.6.25
• 83563d6 Merge pull request #164 from suzuki-shunsuke/renovate/github.com-urfave-cli-v2-2.x
• 2f6b641 fix(deps): update module github.com/urfave/cli/v2 to v2.25.6
• 3df2d0e Merge pull request #163 from suzuki-shunsuke/renovate/github.com-sirupsen-logrus-1.x
• d5b0b15 fix(deps): update module github.com/sirupsen/logrus to v1.9.3
• e9016e6 Merge pull request #162 from suzuki-shunsuke/renovate/github.com-urfave-cli-v2-2.x
• ac3a986 fix(deps): update module github.com/urfave/cli/v2 to v2.25.5
• 27268f0 Merge pull request #161 from suzuki-shunsuke/renovate/github.com-urfave-cli-v2-2.x
• cf83f22 fix(deps): update module github.com/urfave/cli/v2 to v2.25.4
• 109796d Merge pull request #160 from suzuki-shunsuke/renovate/suzuki-shunsuke-go-release-workflow-0.x
• 3702a3a chore(deps): update suzuki-shunsuke/go-release-workflow action to v0.4.2
• 1771d86 Merge pull request #159 from suzuki-shunsuke/renovate/aquaproj-aqua-2.x
• e84ed38 chore(deps): update dependency aquaproj/aqua to v2.8.0
• e26589d Merge pull request #157 from suzuki-shunsuke/renovate/aquaproj-aqua-renovate-config-1.x
• 639321e chore(deps): update dependency aquaproj/aqua-renovate-config to v1.6.0
• fa9fd1f Merge pull request #158 from suzuki-shunsuke/renovate/aquaproj-aqua-renovate-config-file-1.x
• ccd5c20 chore(deps): update dependency aquaproj/aqua-renovate-config:file to v1.6.0
• 39223b0 Merge pull request #156 from suzuki-shunsuke/renovate/aquaproj-aqua-2.x
• c09cddb chore(deps): update dependency aquaproj/aqua to v2.7.1
• 9c61583 Merge pull request #155 from suzuki-shunsuke/renovate/github.com-sirupsen-logrus-1.x
• a03bee9 fix(deps): update module github.com/sirupsen/logrus to v1.9.2
• 3480145 Merge pull request #153 from suzuki-shunsuke/renovate/aquaproj-aqua-2.x
• 060ca76 chore(deps): update dependency aquaproj/aqua to v2.7.0
• 3a37e3c Merge pull request #154 from suzuki-shunsuke/renovate/github.com-sirupsen-logrus-1.x
• f489774 fix(deps): update module github.com/sirupsen/logrus to v1.9.1
• 606ad45 Merge pull request #152 from suzuki-shunsuke/renovate/aquaproj-aqua-2.x
• 7c07300 chore(deps): update dependency aquaproj/aqua to v2.5.2
• 8bdeeac Merge pull request #151 from suzuki-shunsuke/renovate/aquaproj-aqua-2.x
• ed11250 chore(deps): update dependency aquaproj/aqua to v2.5.1
• ef65a08 Merge pull request #150 from suzuki-shunsuke/renovate/goreleaser-goreleaser-1.x
• 36c3442 chore(aqua): update aqua-checksums.json
• ed3ce99 chore(deps): update dependency goreleaser/goreleaser to v1.18.2
• 200d7a2 Merge pull request #149 from suzuki-shunsuke/renovate/aquaproj-aqua-2.x
• a19621d chore(deps): update dependency aquaproj/aqua to v2.5.0
• 51c6d69 Merge pull request #148 from suzuki-shunsuke/renovate/aquaproj-aqua-2.x
• 62bcc73 chore(deps): update dependency aquaproj/aqua to v2.4.3
• 94833fe Merge pull request #147 from suzuki-shunsuke/renovate/aquaproj-aqua-2.x
• b86fff7 chore(deps): update dependency aquaproj/aqua to v2.4.2
• f09ca66 Merge pull request #145 from suzuki-shunsuke/renovate/goreleaser-goreleaser-1.x
• 2528363 chore(aqua): update aqua-checksums.json
• 8738f7d chore(deps): update dependency goreleaser/goreleaser to v1.18.1
• 844945f Merge pull request #144 from suzuki-shunsuke/renovate/aquaproj-aqua-2.x
• 8145b08 chore(deps): update dependency aquaproj/aqua to v2.4.1
• 40423e6 Merge pull request #143 from suzuki-shunsuke/renovate/aquaproj-aqua-2.x
• 9efa6d5 chore(deps): update dependency aquaproj/aqua to v2.4.0
• 5b33d47 Merge pull request #142 from suzuki-shunsuke/renovate/github.com-urfave-cli-v2-2.x
• ae33c08 fix(deps): update module github.com/urfave/cli/v2 to v2.25.3
• 88673d6 Merge pull request #141 from suzuki-shunsuke/renovate/aquaproj-aqua-2.x
• 15ab9f1 chore(deps): update dependency aquaproj/aqua to v2.3.7
• e8cfa0f Merge pull request #140 from suzuki-shunsuke/renovate/github.com-urfave-cli-v2-2.x
• 4c0cd10 fix(deps): update module github.com/urfave/cli/v2 to v2.25.2
• b07c409 Merge pull request #139 from suzuki-shunsuke/renovate/goreleaser-goreleaser-1.x
• 75f92b2 chore(aqua): update aqua-checksums.json
• c24bd8e chore(deps): update dependency goreleaser/goreleaser to v1.17.2
• 0d155b6 Merge pull request #138 from suzuki-shunsuke/renovate/aquaproj-aqua-2.x
• 98e4440 chore(deps): update dependency aquaproj/aqua to v2.3.6
• 461720d Merge pull request #137 from ...

v0.2.2

Pull Requests | Issues | v0.2.1...v0.2.2

Features

#64 Add policies to forbid read-all and write-all permissions

permissions: read-all|write-all

Bug Fixes

#64 Fix a bug that ghalint couldn't parse a workflow using permissions: read-all or permissions: write-all

permissions: read-all|write-all

ERRO[0000] read a workflow file                          error="parse a workflow file as YAML: yaml: unmarshal errors:\n  line 13: cannot unmarshal !!str `read-all` into map[string]string" program=ghalint version=0.2.1 workflow_file_path=.github/workflows/release.yml

v0.2.1

Pull Requests | Issues | v0.2.0...v0.2.1

Features

#35 Support configuring log color mode by environment variable GHALINT_LOG_COLOR

💡 If you want to enable log color in GitHub Actions, please try GHALINT_LOG_COLOR=always

env:
  GHALINT_LOG_COLOR: always

AS IS

TO BE