actionlint vs Checkstyle

actionlint is a static checker for GitHub Actions workflow files. It flags unexpected or missing syntax keys and checks `${{ }}` expressions for semantic issues such as missing properties and mismatched types. It validates action inputs and outputs, along with inputs, outputs, and secrets used in reusable workflows and workflow calls. Security checks cover script injection risks involving untrusted inputs and hard-coded credentials. For scripts in `run:` steps, it can use ShellCheck and Pyflakes integrations, which can be disabled. Installation options documented by the project include prebuilt binaries, Docker, source builds, a CI download script, and package managers. Its browser playground runs through WebAssembly and states that it does not send data outside the browser. The project also describes integrations with code review tools, CI and editors, provides Go APIs, and allows configuration of self-hosted runner labels, configuration variables, and file-specific ignore patterns. actionlint is free and MIT-licensed, with a command-line tool and browser playground. The listed platforms include Linux, macOS, Windows, web, and self-hosted use.

Checkstyle is a free Java source-code analyzer for programmers who follow a coding standard. It checks naming, imports, Javadoc, formatting, class design, and coding practices against configurable rules. You can select supplied Google Java Style, Sun Conventions, OpenJDK Style, or Doc Style configurations, or create your own. Checkstyle runs from its command-line tool or as an Ant task, with documented Maven and Gradle integrations. Listed IDE and CI integrations include Eclipse, Bamboo, GitHub Actions, Codacy, and Code Climate. It runs on Linux, macOS, and Windows. The current site says it parses Java features through Java 25; versions 13.x and 14.x require Java runtime 21 or newer. Analysis is single-file and source-level, without expression-type determination or a full inheritance hierarchy. Releases are available through GitHub releases and Maven Central, including a standalone all-in-one JAR. It is licensed under LGPL-2.1-or-later and supports only the latest version.