[dependabot]

Bumps jdx/jactionlint from 2.4.0 to 2.5.0.

Release notes

Sourced from jdx/jactionlint's releases.

v2.5.0: Run workflows locally with jactionlint run

jactionlint 2.5.0 adds jactionlint run, which runs the jobs of a workflow on your machine inside an OS sandbox, without a container engine. It also adds the unreachable-required-check rule, fixes two unpinned-images issues, and accepts the apm Dependabot ecosystem.

Added

jactionlint run: run workflows locally

jactionlint run lets you debug a run: script, an expression, a matrix or the needs wiring without pushing a commit. It shows what happened on your machine, not whether the workflow will pass on GitHub. Every skip or refusal is printed with its reason, and the run guide has a "Differences from GitHub" table. The workflow is first linted with the correctness profile, and the run stops on an error (--no-lint skips the lint). (#316, #317, #319, #320, #321, #322, #323, #324, @​jdx)

jactionlint run --list                    # jobs and matrix cells in dependency order, nothing runs
jactionlint run ci -j test                # run job `test` of .github/workflows/ci.yml and the jobs it needs
jactionlint run ci --dry-run              # the steps with ${{ }} replaced, nothing runs
jactionlint run ci -e pull_request --secret TOKEN=abc --var REGION=eu
jactionlint run --check-sandbox           # what this machine can enforce

• Plan view. --list (--json for JSON) groups jobs into stages and expands matrices the way the runner does: exclude, then include. It evaluates name:, runs-on: and job if: expressions that it can, and marks each one if is true or if is false. The github context comes from git, -i NAME=VALUE sets workflow_dispatch inputs, and --event-file supplies github.event. A matrix built from needs outputs shows as "known at run time".
• Steps and jobs. Supports run: steps with shell, working-directory, defaults.run, layered env, timeout-minutes and continue-on-error. Also supported: step and job outputs, needs.*.result, matrices with fail-fast, background and parallel: steps, the GITHUB_ENV/PATH/OUTPUT/STATE/STEP_SUMMARY file commands and workflow commands. Values from --secret and ::add-mask:: show as *** in all output. Jobs whose runs-on names a different OS are skipped. Ctrl-C cancels the steps, and steps with if: always() still run.
• Actions and reusable workflows. Runs local, composite and JavaScript actions (with pre/post) and local or remote reusable workflows. If no Node.js on PATH has the right major version, jactionlint downloads it and checks it against the release's SHASUMS256.txt. Remote actions and reusable workflows must be pinned to a commit SHA. Use --trust-actions to resolve a tag or branch and print the commit it picked. actions/checkout, upload-artifact and download-artifact are replaced with local versions. Use --no-shim ACTION to run the real action.
• Local actions cache. A cache service on 127.0.0.1 works with unmodified actions/cache, setup-*, jdx/mise-action and other actions built on @actions/cache, so a second run restores instead of downloading again. Caches are scoped to the ref and fall back to the default branch. Entries expire after 7 days, and the store has a 10 GB LRU limit (--cache-size). Related options: --cache=read-only|off, --no-cache, --cache-dir. Manage the store with jactionlint cache ls|rm|prune|path.
• Network modes. --net=open is the default. --net=none blocks internet sockets. --net=proxy allows only a proxy that lets through GitHub and the common package registries. It needs Landlock ABI 4, which is Linux 6.7 or later. --allow-net HOST,... adds hosts, and --learn prints the hosts your steps contacted.
• Containers (optional). container: jobs, services: and Docker actions run through docker or podman (--container-engine). By default all capabilities are dropped except nine, and no-new-privileges is set. jactionlint never runs privileged containers or mounts the host home or Docker socket. Images must be pinned by digest unless you pass --trust-images. options: is checked against an allow list: --privileged, --cap-add, -v, --network host and similar options are refused unless you pass --unsafe-container-options. Use --container to run Linux matrix cells in a digest-pinned ubuntu image, for example from a Mac. If no engine is installed, or you pass --no-containers, only the jobs and steps that need a container are skipped.
• Parallel runs. --parallel N runs matrix cells and independent jobs at the same time. It respects needs and max-parallel, and prints each job's output in one block.
• Explanations. Messages that end with (jactionlint run --explain ID) have a longer explanation. jactionlint run --explain list lists all of them.

Isolation and platform support: Each step runs with a filtered environment, a throwaway home, and a per-job copy of the workspace. Your checkout and real home cannot be read or written. Use --in-place to work in your checkout, --allow-read/--allow-write DIR to open more paths, and --sandbox=off to turn the sandbox off. If the sandbox can't be applied, the step does not run.

• Linux: Landlock and seccomp-bpf, Linux 5.13 or later.
• macOS: Seatbelt through sandbox-exec. This backend is new and has had much less use than the Linux one.
• Windows: steps are refused. Use WSL2.

New rule: unreachable-required-check

The new unreachable-required-check rule reports a required check that no workflow will report for a change. GitHub waits forever for such a check, and the pull request cannot merge. Common causes are a missing merge_group trigger, a branches filter that leaves out the protected branch, and a paths filter that skips a README-only change. (#331, @​mariusvniekerk)

The rule turns on in every profile when required-checks is in the config file:

required-checks:
  - name: CI gate
    events: [pull_request, merge_group]   # default: [pull_request]
    branches: [main]                      # optional, literal names

It reads every workflow in .github/workflows, so it doesn't report GitHub's workaround of a second workflow with the opposite paths filter. Each finding is placed where the fix goes: the config declaration (with a "did you mean" suggestion), on:, or the filter. When the answer depends on something the rule doesn't evaluate, it reports at level info and gives the reason. It does not read branch protection or rulesets from GitHub, so keep the list in sync with your repository settings. To turn the rule off, set rules: {unreachable-required-check: off}.

Fixed

• unpinned-images now treats images built by drop-in forks of docker/build-push-action as local, the same as the original: useblacksmith/build-push-action, depot/build-push-action and warpbuilds/build-push-action. A later docker run of the image's tag is no longer reported. Other actions that take a tags: input are still reported. (#328, @​jdx, @​tedserbinski)
• unpinned-images now only treats an image as local when the same job builds, tags or loads it. Each job runs on its own runner, so docker run app:ci in a job that doesn't build app:ci pulls the image from the registry. That use is now reported. Previously, a build anywhere in the workflow hid the finding in every job. (#329, @​jdx, @​tedserbinski)

... (truncated)

Changelog

Sourced from jdx/jactionlint's changelog.

Changelog

2.6.0 (2026-11-12)

Features

• download: send JACTIONLINT_TOKEN with the release download (#346) (619a15b)
• update: add jactionlint update for action updates and SHA pinning (#335) (53ee6f0)
• update: run gh actions-lock --relock after update --apply (#341) (20359a0)

Bug Fixes

• deps: raise Go toolchain to go1.27.4 for GO-2026-6859 (#345) (1864974)
• run: run container jobs on the platform of their container (#344) (3e01b7e)
• unpinned-tools: do not report go install tool (#338) (327c574)

2.5.0 (2026-11-04)

Features

• run: add jactionlint run --list (#316) (f1f877e)
• run: add the OS sandbox that steps run in (Landlock, seccomp, Seatbelt) (#319) (443b4c1)
• run: container jobs, services, Docker actions, --container, --parallel, --dry-run (#323) (27dae22)
• run: evaluate workflow expressions in jactionlint run --list (#317) (f4267f7)
• run: local actions cache, --net=proxy and jactionlint cache (#322) (b51ca88)
• run: run actions and reusable workflows (#321) (782e8f9)
• run: run workflow steps in the sandbox (#320) (65614de)
• unreachable-required-check: report required checks that never report (#331) (a4f08e3)

Bug Fixes

• dependabot-syntax: support apm package ecosystem (#333) (c7eafd3)
• unpinned-images: only count images built in the same job (#329) (a09969d)
• unpinned-images: treat images of drop-in forks of docker/build-push-action as local (#328) (4d0fcf6)

2.4.0 (2026-10-28)

Features

• invisible-characters: report Private Use Area characters (#311) (b4a8d08)

Bug Fixes

• artipacked: skip actions/checkout v6 and later (#308) (7a5eb59)

... (truncated)

Commits

• 9e87e8f chore(main): release 2.5.0 (#326)
• c7eafd3 fix(dependabot-syntax): support apm package ecosystem (#333)
• 8bfa2b7 chore: set up jouet for agents (#332)
• a4f08e3 feat(unreachable-required-check): report required checks that never report (#...
• eb7078e test(schema): pin the latest actions/runner schemas (#330)
• a09969d fix(unpinned-images): only count images built in the same job (#329)
• 4d0fcf6 fix(unpinned-images): treat images of drop-in forks of docker/build-push-acti...
• ad5f1f1 docs(run): document running workflows locally and add run --explain (#324)
• 27dae22 feat(run): container jobs, services, Docker actions, --container, --parallel,...
• b51ca88 feat(run): local actions cache, --net=proxy and jactionlint cache (#322)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

⚠️ No Changeset found

Latest commit: 71c332c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR