Rule overview

eslint-plugin-github-actions-2 targets GitHub Actions workflow YAML files, action metadata files (action.yml / action.yaml), repository Dependabot configuration files (.github/dependabot.yml), and workflow-template package files under workflow-templates/.

New to the plugin? Start with Getting started. Need config guidance? See the preset reference. Looking for a specific check? Jump to Current rules.

Included rule categories

• Security: explicit least-privilege permissions and immutable SHA pinning
• Reliability: bounded job timeouts
• Operations: workflow concurrency controls and valid concurrency expression contexts
• Naming and readability: workflow names, job IDs, job names, and step names
• Execution clarity: explicit run-step shells, typed workflow interfaces, canonical manual-dispatch input access, and valid step-context references
• Workflow interface quality: documented manual-dispatch and reusable workflow interfaces plus valid reusable output values and job-output mappings
• Reusable workflow hygiene: explicit checkout ordering, narrowly scoped secret passing, and valid reusable-workflow caller job keys
• Workflow safety: safer conditional secret handling, untrusted-script handling, scoped workflow chaining, safer privileged PR automation, fork-triggered self-hosted runner hardening, and scoped privileged PR targets
• Trigger precision: explicit activity-type scoping for broad multi-activity events and merge-queue-aware pull request validation
• Dependency automation: required Dependabot keys, explicit schedules, PR routing, labels, ownership, and commit-title conventions

Current rules

• require-workflow-permissions
• require-job-timeout-minutes
• pin-action-shas
• require-workflow-concurrency
• action-name-casing
• job-id-casing
• max-jobs-per-action
• no-case-insensitive-input-id-collision
• no-codeql-autobuild-for-javascript-typescript
• no-codeql-javascript-typescript-split-language-matrix
• no-composite-input-env-access
• no-deprecated-node-runtime
• no-duplicate-composite-step-id
• no-empty-template-file-pattern
• no-external-job
• no-hardcoded-default-branch-in-template
• no-icon-file-extension-in-template-icon-name
• no-inherit-secrets
• no-invalid-concurrency-context
• no-invalid-key
• no-invalid-reusable-workflow-job-key
• no-invalid-template-file-pattern-regex
• no-invalid-workflow-call-output-value
• no-overlapping-dependabot-directories
• no-path-separators-in-template-icon-name
• no-post-if-without-post
• no-pr-head-checkout-in-pull-request-target
• no-pre-if-without-pre
• no-required-input-with-default
• no-secrets-in-if
• no-self-hosted-runner-on-fork-pr-events
• no-subdirectory-template-file-pattern
• no-template-placeholder-in-non-template-workflow
• no-top-level-env
• no-top-level-permissions
• no-unused-dependabot-enable-beta-ecosystems
• no-unknown-dependabot-multi-ecosystem-group
• no-universal-template-file-pattern
• no-unknown-input-reference-in-composite
• no-unknown-job-output-reference
• no-unknown-step-reference
• no-unused-input-in-composite
• no-untrusted-input-in-run
• no-write-all-permissions
• prefer-fail-fast
• prefer-action-yml
• prefer-file-extension
• prefer-inputs-context
• prefer-step-uses-style
• prefer-template-yml-extension
• require-action-name
• require-action-run-name
• require-checkout-before-local-action
• require-codeql-actions-read
• require-codeql-branch-filters
• require-codeql-category-when-language-matrix
• require-codeql-pull-request-trigger
• require-codeql-schedule
• require-codeql-security-events-write
• require-composite-step-name
• require-dependabot-automation-permissions
• require-dependabot-automation-pull-request-trigger
• require-dependabot-assignees
• require-dependabot-bot-actor-guard
• require-dependabot-commit-message-include-scope
• require-dependabot-commit-message-prefix
• require-dependabot-commit-message-prefix-development
• require-dependabot-cooldown
• require-dependabot-directory
• require-dependabot-github-actions-directory-root
• require-dependabot-labels
• require-dependabot-open-pull-requests-limit
• require-dependabot-package-ecosystem
• require-dependabot-patterns-for-multi-ecosystem-group
• require-dependabot-schedule-cronjob
• require-dependabot-schedule-interval
• require-dependabot-schedule-time
• require-dependabot-schedule-timezone
• require-dependabot-target-branch
• require-dependabot-updates
• require-dependabot-version
• require-dependabot-versioning-strategy-for-npm
• require-dependency-review-action
• require-dependency-review-fail-on-severity
• require-dependency-review-permissions-contents-read
• require-dependency-review-pull-request-trigger
• require-fetch-metadata-github-token
• require-job-name
• require-job-step-name
• require-merge-group-trigger
• require-pull-request-target-branches
• require-run-step-shell
• require-sarif-upload-security-events-write
• require-scorecard-results-format-sarif
• require-scorecard-upload-sarif-step
• require-secret-scan-contents-read
• require-secret-scan-fetch-depth-zero
• require-secret-scan-schedule
• require-template-categories
• require-template-file-patterns
• require-template-icon-file-exists
• require-template-icon-name
• require-template-workflow-name
• require-trigger-types
• require-workflow-call-input-type
• require-workflow-call-output-value
• require-workflow-dispatch-input-type
• require-workflow-interface-description
• require-workflow-run-branches
• require-workflow-template-pair
• require-workflow-template-properties-pair
• require-trufflehog-verified-results-mode
• valid-timeout-minutes
• valid-trigger-events