actionlint vs PHPMD

actionlint is a static checker for GitHub Actions workflow files. It flags unexpected or missing syntax keys and checks `${{ }}` expressions for semantic issues such as missing properties and mismatched types. It validates action inputs and outputs, along with inputs, outputs, and secrets used in reusable workflows and workflow calls. Security checks cover script injection risks involving untrusted inputs and hard-coded credentials. For scripts in `run:` steps, it can use ShellCheck and Pyflakes integrations, which can be disabled. Installation options documented by the project include prebuilt binaries, Docker, source builds, a CI download script, and package managers. Its browser playground runs through WebAssembly and states that it does not send data outside the browser. The project also describes integrations with code review tools, CI and editors, provides Go APIs, and allows configuration of self-hosted runner labels, configuration variables, and file-specific ignore patterns. actionlint is free and MIT-licensed, with a command-line tool and browser playground. The listed platforms include Linux, macOS, Windows, web, and self-hosted use.

PHPMD analyzes PHP source code for possible bugs, inefficient patterns, complicated expressions, and unused parameters, methods, or properties. Its predefined rules flag code smells and potential errors across categories including clean code, code size, controversial practices, design, naming, and unused code. Teams can add custom rules and use security rules, and PHPMD supports CI workflows. Reports include JSON, SARIF, Checkstyle-compatible, GitHub, and GitLab options, including a GitLab renderer for GitLab CI. The project documents installation through a Phar, PHIVE, or Composer; Phar files are signed with a public key associated with [email protected]. Listed requirements are PHP >= 5.3.9 and PHP_Depend >= 2.0.0. PHPMD is free under the BSD 3-Clause license and runs on Linux, macOS, Windows, or a self-hosted setup. The homepage lists version 2.15.0, dated 2023/12/11, as the latest release shown. Help is available through the Gitter channel, while bugs and feature requests go to the issue tracker.