使用 Homebrew, Nix 安装 ghalint

项目链接

• 主页

命令和别名

• ghalint

项目历史

Shunsuke Suzuki published the first ghalint releases in January 2023. The README describes the tool as a linter for GitHub Actions security best practices, and its policy documents show the early focus: explicit job permissions, avoiding broad read-all or write-all permissions, limiting inherited secrets, and pinning actions to full-length commit SHAs.

The project later documented a port to the lintnet module ecosystem, connecting ghalint's original GitHub Actions rule set with a broader Jsonnet-powered linting framework. That migration path suggests the project became both a standalone binary and a policy corpus that could be reused by another linter.

采用历史

ghalint is a niche security tool rather than a general CI parser. Its adoption path is package-manager friendly: the official install guide lists Homebrew, Scoop, aqua, mise, GitHub Releases, and `go install`, while Homebrew exposes it as a one-command formula. That distribution pattern fits teams that want a small CI hardening check without installing a larger platform.

使用方式

Practitioners run `ghalint run` from a repository root to inspect workflow files under `.github/workflows`, or `ghalint run-action` for `action.yaml` and `action.yml` files. A `ghalint.yaml` configuration file can disable selected policies for named workflows, jobs, or actions when a repository has an intentional exception.

为什么软件包爱好者会关心

For package maintainers, ghalint is notable because it packages CI supply-chain advice as a fast local executable. It complements tools such as actionlint by concentrating on security posture: minimum permissions, safe secret handling, pinned action references, and checkout credential handling.

时间线

• 2023: v0.1.0 was published on GitHub Releases.
• 2023: Early policy docs covered job permissions, workflow secrets, inherited secrets, and immutable action references.
• After 2023: The README documented a ghalint module for lintnet.

Related projects

• lintnet reuses the ghalint policy domain in a general-purpose Jsonnet linter.
• pinact is referenced by ghalint documentation as a helper for converting GitHub Actions tags to full-length commit SHAs.

来源

• https://formulae.brew.sh/formula/ghalint
• https://github.com/suzuki-shunsuke/ghalint
• https://github.com/suzuki-shunsuke/ghalint/blob/main/docs/install.md
• https://github.com/suzuki-shunsuke/ghalint/blob/main/docs/policies/001.md
• https://github.com/suzuki-shunsuke/ghalint/blob/main/docs/policies/008.md
• https://github.com/suzuki-shunsuke/ghalint/releases/tag/v0.1.0