build(deps): bump kjanat/actionlint from 1.13.0 to 1.15.1 in the actions-non-breaking group

[dependabot]

Bumps the actions-non-breaking group with 1 update: kjanat/actionlint.

Updates kjanat/actionlint from 1.13.0 to 1.15.1

Release notes

Sourced from kjanat/actionlint's releases.

v1.15.1 starts checking expression contexts inside referenced local composite actions. It helps catch metadata that looks like a workflow step but uses a context unavailable inside the action, and keeps quoted expression text from producing false findings.

Pass caller values into a composite action explicitly

Composite action steps do not have the same context access as workflow steps. This release checks expressions in step if, run, working-directory, name, with, and env values, reporting references to secrets, vars, or needs.

For example, a local composite action using env: {TOKEN: '${{ secrets.TOKEN }}'} is reported at its metadata file. Pass the value as an input instead:

name: Example
description: Receive a token from the calling workflow
inputs:
  token:
    description: Token supplied by the caller
    required: true
runs:
  using: composite
  steps:
    - shell: bash
      env:
        TOKEN: ${{ inputs.token }}
      run: test -n "$TOKEN"

The calling workflow supplies it with with: {token: '${{ secrets.TOKEN }}'}. That keeps the context lookup where it is available and makes the action's input contract explicit. Values derived from workflow needs belong on the caller side too.

These are context-availability checks, not a complete type environment for every composite action expression. The linter follows referenced local action metadata; it does not fetch arbitrary remote actions. Thanks @​johnament for kjanat/actionlint#124, continuing work toward rhysd/actionlint#46.

Treat quoted delimiters as string content

The expression scanner uses the lexer's consumed offset to distinguish a real closing delimiter from }} inside a quoted string. This valid composite step name does not refer to the secrets context:

name: ${{ 'text }} ${{ secrets.TOKEN }}' }}

The content inside the single quotes is a literal string. It should not produce a context error merely because it contains text resembling another expression. Regression coverage includes following real expressions, escaped quotes, and UTF-8 text. Related: kjanat/actionlint#124.

Keep floating action tags publishable

The floating-tag update no longer depends on the GPG signing service. A signing-service failure therefore cannot block publication of the commit that pins the action image by digest. The exact version tag remains on the release commit; moving aliases point to the separate image-pinning commit.

Bring installation guidance up to date

Documentation now reflects the published npm and AUR packages, the canonical Homebrew tap, WinGet's pending review, and immutable-release handling. The upstream tracker also records the composite checks, released feature versions, and Go 1.26 compatibility.

Upgrade from v1.15.0 if you maintain or call local composite actions: this patch can catch context mistakes before you run the workflow while accepting quoted strings that only resemble expressions.

Full changelog

... (truncated)

Changelog

Sourced from kjanat/actionlint's changelog.

Unreleased

• Link CLI help to documentation at the release tag or development build's commit, including Go pseudo-versions and Makefile builds.
• Add documented ACTIONLINT_* defaults for configuration selection, output, filters, logging and presentation. Split external-linter environment settings into literal BIN, argument FLAGS, and child ENV values for both ShellCheck and Pyflakes. Explicit flags override environment defaults, including empty and false values.
• Pretty-print JSON metadata and JSON/SARIF diagnostics with installed jq when stdout is a terminal. Respect color controls and provide --json-pretty=false. Keep redirected output, JSONL, templates and stderr records unchanged; fall back to the original JSON if jq is unavailable or fails.
• Make directory, configuration and executable paths in doctor clickable with OSC 8 file:// links. Follow the existing hyperlink controls and preserve JSON output. Encode special characters in link targets and support Windows drive and UNC paths.
• Enable color automatically in GitHub Actions logs when GITHUB_ACTIONS=true. Respect NO_COLOR and explicit color controls, and keep automatic styling out of report files, structured output and custom templates.
• Add OSC 8 links to the project name and URLs in CLI help. --hyperlinks=auto|always|never follows the no-hyperlinks convention, including NO_HYPERLINKS and FORCE_HYPERLINKSkjanat/actionlint#65
• Rebuild the CLI with a typed invocation model, a preserved Go flag parser for root calls, and Cobra commands for check, config inspection, rules, doctor, completion and version. Add JSON/JSONL/SARIF/GitHub output, template and output files, opt-in summaries, configuration origins and generated four-shell completion. Style terminal help while respecting color controls, add -V as a version alias, align doctor output, and keep concurrent verbose/debug log records intact. Preserve legacy options, templates, default diagnostics, version output, streams and exit codes. Test both grammars, command/file collisions and output side effects. Use the same input resolution, analysis results and renderers for commands and legacy Lint* methods. Preserve callbacks, working-directory handling and legacy write-error behavior. Protect all consumed local inputs from report replacement and retain configuration provenance through YAML merges. Move the frontend into internal/cli so library and Wasm builds do not import Cobra or pflag; Go callers migrating from the former root Command type can use the shared analysis APIs.
• kjanat/actionlint#171

v1.17.0 - 2026-09-13

• kjanat/actionlint#167

• kjanat/actionlint#168

• Upgrade note: the three new cache safety policies are enabled even without a configuration file and can make previously clean workflows exit with status 1. Disable individual checks with policy.cache-write-untrusted: false, policy.cache-call-unrestricted: false, or policy.cache-operation: falsekjanat/actionlint#165

• Support current workflow schema fields and expression objects, including workflow descriptions, cancellation timeouts, image-version filters, stacked pull requests, empty choice options, disabled service images, and UTC timezone aliases.

• Validate action manifests against generated runner schema constraints. Correct workflow expression contexts, matrix inference, function arity, expression depth, scalar decoding, required flags, schedule entries, and step ID checks.

• Document the pinned workflow/action schema audit, complete definition coverage, regression evidence, and retained compatibility differences.

• Enable cache safety policies by default: report explicit writes on low-trust triggers that can use default-branch caches, reusable calls without an explicit cache limit on those triggers, and official cache actions disabled by an explicit mode. Each policy can be disabled in configuration or suppressed on a specific line with a rule name and a reason.

• Add policy.disallow-suppressions to prohibit inline cache exceptions for all or selected rules. Select report: suppression, violation, or allkjanat/actionlint#165

• Support workflow- and job-level cache-mode values, including jobs that call reusable workflows. Check explicit cache access limits through nested local workflow calls, preserving job overrides and the distinction between omitted settings and nonekjanat/actionlint#163

• kjanat/actionlint#164kjanat/actionlint#165)

[Changes][v1.17.0]

v1.16.1 - 2026-09-09

• Report YAML alias type errors at each invalid alias use, with the anchor location included in the message. Preserve source locations inside anchored content and avoid missing-ref errors for malformed useskjanat/actionlint#149kjanat/actionlint#154)

• kjanat/actionlint#150

• kjanat/actionlint#151NixOS/nixpkgs#561437; thanks @​voidlily for the initial packaging proposal.)

• kjanat/actionlint#151

... (truncated)

Commits

• b092abd bump up version to v1.15.1
• 55daf09 Refresh upstream tracking and release guidance
• 6dbddc5 Check contexts used in composite action step expressions (#124)
• f80eaac Refresh installation and release documentation
• 0ffac22 Remove signing from floating action tags
• 57fb542 Fix signing of floating action tags
• d13bb9b Isolate the changelog monitor dependency install
• 353d50c bump up version to v1.15.0
• 43a421f Refresh action pins and expose the changelog reader
• bd9e2eb Prepare schema initialization and release checks
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions