actionlint vs Hadolint

actionlint is a static checker for GitHub Actions workflow files. It flags unexpected or missing syntax keys and checks `${{ }}` expressions for semantic issues such as missing properties and mismatched types. It validates action inputs and outputs, along with inputs, outputs, and secrets used in reusable workflows and workflow calls. Security checks cover script injection risks involving untrusted inputs and hard-coded credentials. For scripts in `run:` steps, it can use ShellCheck and Pyflakes integrations, which can be disabled. Installation options documented by the project include prebuilt binaries, Docker, source builds, a CI download script, and package managers. Its browser playground runs through WebAssembly and states that it does not send data outside the browser. The project also describes integrations with code review tools, CI and editors, provides Go APIs, and allows configuration of self-hosted runner labels, configuration variables, and file-specific ignore patterns. actionlint is free and MIT-licensed, with a command-line tool and browser playground. The listed platforms include Linux, macOS, Windows, web, and self-hosted use.

Hadolint is a free Dockerfile linter that parses files into an abstract syntax tree and checks that structure for errors and stated best practices. It uses ShellCheck to inspect Bash code inside Dockerfile RUN instructions. Rules carry either the DL prefix for Hadolint checks or SC for ShellCheck checks. Users can ignore rules, override severity, set failure thresholds, choose report formats, and configure label schemas and trusted registries. Output formats include tty, JSON, Checkstyle, Code Climate, GitLab Code Climate, GNU, Codacy, SonarQube, SARIF, and JUnit. Hadolint runs in Docker or Podman containers and is available as a pre-commit hook. Prebuilt binaries support Linux, macOS, and Windows; installation options include Homebrew, Scoop, Nix, containers, and source builds. Documented integrations cover major CI systems and editors. An online version is hosted at hadolint.github.io/hadolint. The latest listed release is v2.15.1, under GPL-3.0.