actionlint vs detekt

actionlint is a static checker for GitHub Actions workflow files. It flags unexpected or missing syntax keys and checks `${{ }}` expressions for semantic issues such as missing properties and mismatched types. It validates action inputs and outputs, along with inputs, outputs, and secrets used in reusable workflows and workflow calls. Security checks cover script injection risks involving untrusted inputs and hard-coded credentials. For scripts in `run:` steps, it can use ShellCheck and Pyflakes integrations, which can be disabled. Installation options documented by the project include prebuilt binaries, Docker, source builds, a CI download script, and package managers. Its browser playground runs through WebAssembly and states that it does not send data outside the browser. The project also describes integrations with code review tools, CI and editors, provides Go APIs, and allows configuration of self-hosted runner labels, configuration variables, and file-specific ignore patterns. actionlint is free and MIT-licensed, with a command-line tool and browser playground. The listed platforms include Linux, macOS, Windows, web, and self-hosted use.

detekt is a free static code analyzer for Kotlin that helps identify code smells. It supports Android, JVM, JS, Native, and Multiplatform projects, and runs on Linux, macOS, and Windows. Developers can configure rule sets, create baselines for existing issues, and suppress findings with @Suppress annotations. Reports can be generated as HTML, Markdown, SARIF, Checkstyle XML, or custom formats; complexity reports can include lines of code, cyclomatic complexity, and code smell counts. The project provides a Gradle plugin and documents use with Gradle, Maven, and Bazel builds. Its Gradle plugin requires Gradle 6.8.3 or higher. Custom rule sets can be added through detekt's RuleSetProvider and ServiceLoader pattern, and the marketplace lists community rules, extensions, and plugins. CLI installation guidance covers Homebrew on macOS, Scoop on Windows, SDKMAN on Unix-like systems, and NixOS. detekt supports autofix, IDE use, and CI. Its security policy says patches are applied up to the current minor version, with earlier versions handled case by case.