Update dependency github:kjanat/actionlint to v1.16.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
github:kjanat/actionlint	tools	minor	1.14.0 → 1.16.0	v1.16.1

---

Release Notes

kjanat/actionlint (github:kjanat/actionlint)

v1.16.0

Compare Source

• Derive the Playground version badge and links from Git during the Vite build, and redeploy after successful releases. Releases no longer require editing the Playground HTML. (#​144)

• Add inclusive min-minutes bounds to the require-job-timeout policy, validate minimum/maximum ranges, and expose RequireJobTimeoutRange in the Go API. (#​55)

• Add the opt-in require-permissions policy for explicit workflow-level or per-job permission declarations, including reusable workflow calls. Empty permission mappings satisfy the check. (#​83; rhysd#728)

• Retry failed GitHub release requests when installing Pandoc in CI, replacing partial downloads and retaining asset verification before installation. (#​138)

• Reject YAML anchor and alias names containing +, which GitHub Actions does not accept. (#​114)

• Compare matrix scalars by YAML type and resolved value. Keep quoted numbers distinct from numbers, recognize equivalent numeric spellings, and preserve the distinction in diagnostics. (#​57)

• Validate matrix exclusions against the original rows. Values added by include cannot satisfy an exclusion because GitHub processes them afterwards. (rhysd#634, thanks @​muzimuzhi for the report)

• Place required-actions errors at the first job that runs its own steps when an earlier job calls a reusable workflow. (#​54)

• Include and export actionlint.schema.json in @kjanat/actionlint, and export package.json from every platform package. (#​136)

• Generate accepted JavaScript action runtimes, bundled-runtime availability, and deprecation details from GitHub's runner source. Distinguish invalid metadata values from deprecated and removed runtimes, report Node 20 deprecation for local and known popular actions, and preserve input/output validation for deprecated actions. Refresh the data through go generate and weekly Upkeep.

• Allow the windows-11-arm alias to overlap windows-11-vs2026-arm during its announced Visual Studio 2026 migration while retaining incompatible image diagnostics. (#​126)

• Check expressions in composite action input defaults against the runner's narrower set of available contexts, reporting errors at the value in the metadata file. (rhysd#46, #​131, thanks @​johnament)

• Generate action metadata context and special-function rules, including composite step keys, from GitHub's runner schema through the existing go generate and weekly Upkeep flow. Extend input-default checks to JavaScript and Docker actions, check composite shell, continue-on-error, and whole with/env expressions, and report unavailable status functions or incorrect special-function argument counts. Builds and lint runs use the generated data without downloading the schema. This continues @​johnament's work in #​124 and #​131.

• Use npm trusted publishing through OIDC for the launcher, platform packages, and changelog package. Standardize workflow filenames on .yml and update workflow references and publishing configuration.

[Changes][v1.16.0]

v1.15.1

Compare Source

• Check contexts used in ${{ }} expressions inside runs.steps of a composite action. The secrets, vars, and needs contexts are not available to composite actions; secrets and vars must be passed as action inputs:. This is a first step toward checking the contents of steps: in action metadata files. (rhysd#46, #​124, thanks @​johnament)

• Respect quoted }} delimiters when scanning composite step expressions, avoiding false context errors for expression-like text inside strings. Cover following expressions, escaped quotes, and UTF-8 text with regression tests. (#​124)

• Remove the GPG signing service from floating action tag updates so a signing failure cannot block publishing the digest-pinned action commit. Exact release tags remain separate from these moving aliases.

• Refresh installation and release documentation for the published npm and AUR packages, pending WinGet review, the canonical Homebrew tap, and immutable releases. Update the upstream tracker with released feature versions, Go 1.26 compatibility, and the composite context checks.

[Changes][v1.15.1]

v1.15.0

Compare Source

• Add a generated actionlint.schema.json for configuration completion, hover documentation, and validation in editors. actionlint -init-config now includes the YAML Language Server schema directive automatically. The schema follows the Go configuration types and documents where editor validation differs from runtime parsing. (#​120)

• Restore Go 1.26 compatibility for source builds and go install, while retaining Go 1.27.1 as the preferred development toolchain. (#​111)

• Distribute the release binaries through @kjanat/actionlint on npm, with eleven platform packages, a launcher that selects the host binary, and the manpage. Call npm publishing as a reusable workflow after the release binaries are uploaded, attested, and checked, avoiding the suppressed release: published event when releases use GITHUB_TOKEN. Dry runs can test current packaging sources against an existing release. (#​95, #​123)

• Add automated release updates for the kjanat/actionlint Scoop package, the actionlint-kjanat and actionlint-kjanat-bin AUR packages, and WinGet submissions under kjanat.actionlint. The AUR also provides actionlint-kjanat-git for builds from master; WinGet availability follows review in winget-pkgs. Each distribution uses a separate identity for this fork. (#​96, #​97, #​98)

• Publish the Homebrew cask only to kjanat/tap, with a manpage and generated Bash, Fish, Zsh, and PowerShell completions (#​113, thanks @​muzimuzhi). The former kjanat/actionlint tap redirects through migration metadata. ShellCheck is optional and can be installed separately from kjanat/tap/shellcheck. (#​121)

• Pin kjanat/runner and vedantmgoyal9/winget-releaser to commit SHAs in the workflows. (#​115, thanks @​sethbacon for the report; #​118)

• Refresh the command manual and installation guide to describe current flags, configuration, output formats, completions, and package availability. Document mise's github:kjanat/actionlint backend and distinguish fork packages from upstream packages. Update workflow action pins and checkout examples, and link the GitHub Actions changelog reader from the README, docs, and playground. Isolate the changelog monitor's dependency installation from npm workspaces. Extend the version-bump script to cover npm examples and the AUR git package template. (#​123)

• Name the fork version in the README demo section next to the upstream one, and keep both current through the new Upkeep workflow. It regenerates the section after every release and weekly, and opens a pull request when the text moved, so the default branch no longer goes red the moment this fork or upstream ships. The weekly go generate and go-shellcheck bumps moved into the same workflow, each on its own pull request branch, and make lint no longer compares the README against the releases. The README check still runs on pull requests that touch the fixture, the script, or the section.

[Changes][v1.15.0]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.