Sourced from github.com/rhysd/actionlint's releases.

v1.6.18

• This release much enhances checks for local reusable workflow calls. Note that these checks are done for local reusable workflows (starting with ./). (#179).
  • Detect missing required inputs/secrets and undefined inputs/secrets at jobs.<job_id>.with and jobs.<job_id>.secrets. See the document for more details.

    # .github/workflows/reusable.yml
    on:
      workflow_call:
        inputs:
          name:
            type: string
            required: true
        secrets:
          password:
            required: true
    ...
    .github/workflows/test.yml
    ...
    jobs:
    missing-required:
    uses: ./.github/workflows/reusable.yml
    with:
    # ERROR: Undefined input "user"
    user: rhysd
    # ERROR: Required input "name" is missing
    secrets:
    # ERROR: Undefined secret "credentials"
    credentials: my-token
    # ERROR: Required secret "password" is missing

  • Type check for reusable workflow inputs at jobs.<job_id>.with. Types are defined at on.workflow_call.inputs.<name>.type in reusable workflow. actionlint checks types of expressions in workflow calls. See the document for more details.

    # .github/workflows/reusable.yml
    on:
      workflow_call:
        inputs:
          id:
            type: number
          message:
            type: string
    ...
    .github/workflows/test.yml
    ...
    jobs:
    type-checks:
    uses: ./.github/workflows/reusable.yml
    with:

... (truncated)

Sourced from github.com/rhysd/actionlint's changelog.

v1.6.18 - 17 Sep 2022

• This release much enhances checks for local reusable workflow calls. Note that these checks are done for local reusable workflows (starting with ./). (#179).
  • Detect missing required inputs/secrets and undefined inputs/secrets at jobs.<job_id>.with and jobs.<job_id>.secrets. See the document for more details.

    # .github/workflows/reusable.yml
    on:
      workflow_call:
        inputs:
          name:
            type: string
            required: true
        secrets:
          password:
            required: true
    ...
    .github/workflows/test.yml
    ...
    jobs:
    missing-required:
    uses: ./.github/workflows/reusable.yml
    with:
    # ERROR: Undefined input "user"
    user: rhysd
    # ERROR: Required input "name" is missing
    secrets:
    # ERROR: Undefined secret "credentials"
    credentials: my-token
    # ERROR: Required secret "password" is missing

  • Type check for reusable workflow inputs at jobs.<job_id>.with. Types are defined at on.workflow_call.inputs.<name>.type in reusable workflow. actionlint checks types of expressions in workflow calls. See the document for more details.

    # .github/workflows/reusable.yml
    on:
      workflow_call:
        inputs:
          id:
            type: number
          message:
            type: string
    ...
    .github/workflows/test.yml
    ...
    jobs:
    type-checks:
    uses: ./.github/workflows/reusable.yml

... (truncated)

• 14b8067 bump up version to v1.6.18
• dc6c65b do not run go generate when linting files on CI
• 851954c Merge pull request #215 from rhysd/ci/3071750523
• c57c1ba update generated files by go generate on CI
• 293a0eb describe errors on workflow call with undefined inputs
• b32fb43 fix fuzz tests build error
• 89879ab add missing runner.debug property and fix type of services.\<id>.ports
• 7e1e2c7 describe error raised when local workflow does not exist
• 3136b0a add missing github.action_status property
• 05888fd Merge branch 'workflow-call-check' (fix #179)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)