actionlint vs JSHint

actionlint is a static checker for GitHub Actions workflow files. It flags unexpected or missing syntax keys and checks `${{ }}` expressions for semantic issues such as missing properties and mismatched types. It validates action inputs and outputs, along with inputs, outputs, and secrets used in reusable workflows and workflow calls. Security checks cover script injection risks involving untrusted inputs and hard-coded credentials. For scripts in `run:` steps, it can use ShellCheck and Pyflakes integrations, which can be disabled. Installation options documented by the project include prebuilt binaries, Docker, source builds, a CI download script, and package managers. Its browser playground runs through WebAssembly and states that it does not send data outside the browser. The project also describes integrations with code review tools, CI and editors, provides Go APIs, and allows configuration of self-hosted runner labels, configuration variables, and file-specific ignore patterns. actionlint is free and MIT-licensed, with a command-line tool and browser playground. The listed platforms include Linux, macOS, Windows, web, and self-hosted use.

JSHint is a free, open-source static analysis tool for JavaScript. It checks code for syntax errors and potential problems such as implicit type conversion issues and leaking variables. The project aims to help JavaScript developers avoid typos and language gotchas while working on complex programs. JSHint is distributed as a Node module with a library and command-line program, and it can also be used through a JavaScript API. Configuration can come from command-line options, a .jshintrc file, package.json, or inline source directives. Standalone files are available for browser-like environments and Mozilla Rhino, with releases published to npm for Node.js. The install page lists integrations for editors and IDEs including Vim, Emacs, Sublime Text, Visual Studio, VS Code, Eclipse, and JetBrains IDEs, plus build integrations such as Grunt, Ant, Maven, pre-commit, and QUnit. JSHint is licensed under the MIT Expat license. Its documentation cautions that static analysis cannot determine whether a program is correct or fast, or whether it has memory leaks, and recommends using it alongside unit and functional tests and code reviews.