actionlint vs ShellCheck

actionlint is a static checker for GitHub Actions workflow files. It flags unexpected or missing syntax keys and checks `${{ }}` expressions for semantic issues such as missing properties and mismatched types. It validates action inputs and outputs, along with inputs, outputs, and secrets used in reusable workflows and workflow calls. Security checks cover script injection risks involving untrusted inputs and hard-coded credentials. For scripts in `run:` steps, it can use ShellCheck and Pyflakes integrations, which can be disabled. Installation options documented by the project include prebuilt binaries, Docker, source builds, a CI download script, and package managers. Its browser playground runs through WebAssembly and states that it does not send data outside the browser. The project also describes integrations with code review tools, CI and editors, provides Go APIs, and allows configuration of self-hosted runner labels, configuration variables, and file-specific ignore patterns. actionlint is free and MIT-licensed, with a command-line tool and browser playground. The listed platforms include Linux, macOS, Windows, web, and self-hosted use.

ShellCheck is a free static analysis tool for Bash and sh scripts. It flags syntax problems, semantic issues, and subtle pitfalls that could make scripts fail in future circumstances, then offers warnings and suggestions. You can paste a script into ShellCheck.net or run it from a terminal with `shellcheck yourscript`.

The project lists integrations for Vim, Emacs, Sublime, Pulsar Edit, and VS Code, along with GCC-compatible warnings for other editors. It can also be added to builds or test suites, with support listed for services including Travis CI, Codacy, Code Climate, CodeFactor, CircleCI, GitHub Actions, and Trunk. Output options include JSON, CheckStyle-compatible XML, GCC-compatible warnings, and readable text with or without ANSI colors. Installation routes include package managers, precompiled binaries, Docker, and source compilation. ShellCheck is licensed under GPLv3; its wiki documents the tool, and bugs can be reported through GitHub issues. There are no official Apple Silicon binaries, and compiling from source requires 2 GB of RAM.