actionlint vs PMD

actionlint is a static checker for GitHub Actions workflow files. It flags unexpected or missing syntax keys and checks `${{ }}` expressions for semantic issues such as missing properties and mismatched types. It validates action inputs and outputs, along with inputs, outputs, and secrets used in reusable workflows and workflow calls. Security checks cover script injection risks involving untrusted inputs and hard-coded credentials. For scripts in `run:` steps, it can use ShellCheck and Pyflakes integrations, which can be disabled. Installation options documented by the project include prebuilt binaries, Docker, source builds, a CI download script, and package managers. Its browser playground runs through WebAssembly and states that it does not send data outside the browser. The project also describes integrations with code review tools, CI and editors, provides Go APIs, and allows configuration of self-hosted runner labels, configuration variables, and file-specific ignore patterns. actionlint is free and MIT-licensed, with a command-line tool and browser playground. The listed platforms include Linux, macOS, Windows, web, and self-hosted use.

PMD is a free, extensible static code analyzer that checks source code for programming flaws such as unused variables, empty catch blocks, and unnecessary object creation. It includes more than 400 built-in rules, and teams can write custom rules in Java or XPath. Its bundled CPD tool finds duplicated code across many programming languages. PMD checks source directories from the command line and can run as a Maven, Ant, Gradle, or bld build operation. Supported languages include Java, JavaScript, Salesforce Apex and Visualforce, Kotlin, Swift, Modelica, PL/SQL, Apache Velocity, JSP, WSDL, Maven POM, HTML, XML, and XSL; Scala is supported without Scala rules. It runs on Linux, macOS, and Windows and requires Java 8 or above. For CI, its GitHub Action can create SARIF reports and fail builds based on violation counts; documentation also covers GitLab, Jenkins, and Bamboo integrations. IDE integrations include Eclipse, IntelliJ IDEA, and Visual Studio Code, though some listed plugins are not actively maintained. Only the latest major version is actively developed.