actionlint vs Biome

actionlint is a static checker for GitHub Actions workflow files. It flags unexpected or missing syntax keys and checks `${{ }}` expressions for semantic issues such as missing properties and mismatched types. It validates action inputs and outputs, along with inputs, outputs, and secrets used in reusable workflows and workflow calls. Security checks cover script injection risks involving untrusted inputs and hard-coded credentials. For scripts in `run:` steps, it can use ShellCheck and Pyflakes integrations, which can be disabled. Installation options documented by the project include prebuilt binaries, Docker, source builds, a CI download script, and package managers. Its browser playground runs through WebAssembly and states that it does not send data outside the browser. The project also describes integrations with code review tools, CI and editors, provides Go APIs, and allows configuration of self-hosted runner labels, configuration variables, and file-specific ignore patterns. actionlint is free and MIT-licensed, with a command-line tool and browser playground. The listed platforms include Linux, macOS, Windows, web, and self-hosted use.

Biome is a toolchain for maintaining the health of web projects. It formats JavaScript, TypeScript, JSX, TSX, JSON, HTML, CSS, and GraphQL, and provides lint rules for JavaScript, TypeScript, JSX, CSS, and GraphQL. Linting can report diagnostics and apply safe fixes. Its check command can format files, lint them, and organize imports in one run. Biome is distributed as a standalone executable, so it does not require Node.js. Installation instructions cover npm, pnpm, bun, deno, and yarn. First-party editor extensions are available for VS Code, IntelliJ, and Zed; community extensions include Vim, Neovim, and Sublime Text. The getting-started guide links to CI integrations for GitHub Actions and GitLab CI. Biome describes itself as open source and lists MIT or Apache 2.0 licensing. The open-source toolchain is free. Contributors may offer commercial support, but requests depend on their availability.