build(deps): bump kjanat/actionlint from 1.14.0 to 1.16.1

[dependabot]

Bumps kjanat/actionlint from 1.14.0 to 1.16.1.

Release notes

Sourced from kjanat/actionlint's releases.

v1.16.1

actionlint 1.16.1 fixes source builds that run the full test suite without a Git checkout, adds a Nix flake, and makes YAML alias errors point at the place that needs correcting. It also strengthens the tests that check actionlint against GitHub's own fixtures and large embedded shell scripts.

Install directly with Nix

The repository now provides a flake that builds actionlint from source. With flakes enabled, run the pinned release without adding it to your profile:

nix run github:kjanat/actionlint/v1.16.1 -- -version

Or install it:

nix profile add github:kjanat/actionlint/v1.16.1

The package includes ShellCheck and Pyflakes on its executable's search path, Bash/Zsh/Fish completions, the manual page, and the configuration schema. The flake supports Linux on x86-64 and ARM64, and macOS on Apple Silicon. A development shell supplies the build and test tools as well.

This is the project-owned flake. The separate proposal to package this fork in nixpkgs remains under review in NixOS/nixpkgs#561437. Thanks @​voidlily for the initial packaging proposal and for checking the source-build fixes in that work. Related: kjanat/actionlint#151.

Source archives can run the complete test suite

Package builders often work from an extracted archive with no .git directory. In 1.16.0, the documentation checker's tests could crash in that environment because they assumed project discovery had found a Git repository.

The checker now handles that missing metadata while retaining checks for local reusable workflows and consistent diagnostic paths. With the test dependencies installed, the full suite can run from the extracted source:

go test ./...

The Nix package explicitly runs this command. Restricting the build to cmd/actionlint is appropriate for selecting the executable, but testing only that package misses the actual linter and script tests. The new package runs those tests before installation, then checks the installed binary and its supporting files.

For packagers who hit the 1.16.0 source-test failure, this release includes the fixes already tested on master; there is no need to initialize a dummy Git repository. Related: kjanat/actionlint#151.

YAML alias errors point to the incorrect use

An anchor gives a YAML value a name; an alias reuses that value. An anchor on a complete step names a mapping, so using its alias as the value of uses is a type error:

on: push
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - &Checkout {uses: actions/checkout@v7}
      - uses: *Checkout

Previously, the diagnostic pointed back to the valid anchor declaration. It could also add a misleading error about an action missing its ref.

... (truncated)

Changelog

Sourced from kjanat/actionlint's changelog.

Unreleased

• kjanat/actionlint#171

v1.17.0 - 2026-09-13

• kjanat/actionlint#167

• kjanat/actionlint#168

• Upgrade note: the three new cache safety policies are enabled even without a configuration file and can make previously clean workflows exit with status 1. Disable individual checks with policy.cache-write-untrusted: false, policy.cache-call-unrestricted: false, or policy.cache-operation: falsekjanat/actionlint#165

• Support current workflow schema fields and expression objects, including workflow descriptions, cancellation timeouts, image-version filters, stacked pull requests, empty choice options, disabled service images, and UTC timezone aliases.

• Validate action manifests against generated runner schema constraints. Correct workflow expression contexts, matrix inference, function arity, expression depth, scalar decoding, required flags, schedule entries, and step ID checks.

• Document the pinned workflow/action schema audit, complete definition coverage, regression evidence, and retained compatibility differences.

• Enable cache safety policies by default: report explicit writes on low-trust triggers that can use default-branch caches, reusable calls without an explicit cache limit on those triggers, and official cache actions disabled by an explicit mode. Each policy can be disabled in configuration or suppressed on a specific line with a rule name and a reason.

• Add policy.disallow-suppressions to prohibit inline cache exceptions for all or selected rules. Select report: suppression, violation, or allkjanat/actionlint#165

• Support workflow- and job-level cache-mode values, including jobs that call reusable workflows. Check explicit cache access limits through nested local workflow calls, preserving job overrides and the distinction between omitted settings and nonekjanat/actionlint#163

• kjanat/actionlint#164kjanat/actionlint#165)

[Changes][v1.17.0]

v1.16.1 - 2026-09-09

• Report YAML alias type errors at each invalid alias use, with the anchor location included in the message. Preserve source locations inside anchored content and avoid missing-ref errors for malformed useskjanat/actionlint#149kjanat/actionlint#154)

• kjanat/actionlint#150

• kjanat/actionlint#151NixOS/nixpkgs#561437; thanks @​voidlily for the initial packaging proposal.)

• kjanat/actionlint#151

• kjanat/actionlint#148

• kjanat/actionlint#147

• kjanat/actionlint#146rhysd/actionlint#651)

... (truncated)

Commits

• 662318d bump up version to v1.16.1
• 10debd7 Complete the v1.16.1 changelog
• 707c656 Report YAML alias errors at their use sites (#154)
• a4dfe7e Share workflow setup and pin ShellCheck across runners (#152)
• 13febdd Add Nix source packaging and release checks (#151)
• 6051eeb Keep test repositories outside the checkout (#150)
• 31c3a5d Restrict Pages builds and deployment permissions (#148)
• d4ecfd7 Clarify installation sources and pause WinGet PRs
• 676b9e5 Add upstream conformance tests (#147)
• dbf2f0b Cover large-script ShellCheck regressions (#146)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)