Check GitHub Actions before merging workflows

GitHub Actions workflows need checks before they receive repository access. The actionlint, zizmor, pinact, ratchet and act projects cover different parts of that review. ^[1]^[2]^[3]^[4]^[5]

Check syntax and security

Install actionlint and zizmor using their linked installation instructions. From your repository, actionlint checks workflow syntax and expressions; zizmor scans for security problems. ^[1]^[2]

bash

actionlint
zizmor .

Read the reported file locations and fix each finding before running the workflow.

Pin action versions

Per the pinact README, this command edits workflow and composite-action files to pin action references. Review its changes before committing them. ^[3]

bash

pinact run

Use ratchet to check those pins afterward. Its lint command exits unsuccessfully when it finds an unpinned reference. ^[4]

bash

ratchet lint .github/workflows/*.yml

List the jobs before a local run

The act documentation provides a list mode for a specific event. ^[5]

bash

act -l pull_request

You should see the jobs for that event. A full run requires a working container setup and the event inputs your workflow uses. Review the workflow before allowing it to run locally, where it can execute its commands. ^[5]

Keep these checks in the pull-request review so a passing local run is one piece of evidence about the change.