# github-actions

> GitHub Actions workflows: valid syntax and expressions, security audits, and pinned actions.

GitHub Actions workflows: valid syntax and expressions, security audits, and pinned actions.

## Checks

| Check                                                                       | Stage    | Level         | What it does                                                                                                                             |
| --------------------------------------------------------------------------- | -------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| [`github-actions/actionlint`](/reference/checks/github-actions/actionlint/) | `commit` | `recommended` | Checks every GitHub Actions workflow with actionlint: syntax, expressions, action inputs, and shell steps.                               |
| [`github-actions/zizmor`](/reference/checks/github-actions/zizmor/)         | `commit` | `recommended` | Audits GitHub Actions workflows and composite actions with zizmor for template injection, excessive permissions, and dangerous triggers. |

## Selected when

gspot selects it in a scope with file paths `**/.github/workflows/*.{yml,yaml}`, `**/action.{yml,yaml}`.

## Rules for coding agents

| Rule file                                                                     | Installed when |
| ----------------------------------------------------------------------------- | -------------- |
| `.gspot/configurations/infrastructure/github-actions/rules/GITHUB-ACTIONS.md` | Always         |

## Tools and versions

| Tool       | Version  |
| ---------- | -------- |
| actionlint | `1.7.12` |
| shellcheck | `0.11.0` |
| zizmor     | `1.30.1` |

## Files gspot writes

gspot writes `.gspot/configurations/infrastructure/github-actions/zizmor.yml`.