[jdx]

🤖 I have created a release beep boop

2.2.0 (2026-10-14)

Features

• action-input-dependencies: report inputs of well-known actions that need each other (#207) (ef17270)
• action-release-cooldown: report an action at a version younger than N days (online, opt-in) (#235) (7dbd838)
• action: check the inputs of any remote action against its action.yml with --online (#231) (ac30cbe)
• actions-lock: lint GitHub's Actions lock file against the workflows (#237) (c9d8944)
• argument-injection: report free text in the program or the options of sed, awk, find and tar (#221) (ecf46dc)
• aube: understand aube in the rules that know npm, pnpm, yarn and bun (#254) (f6d9319)
• cache-poisoning: add pnpm/setup, graalvm and composer, and report caches of credential files (#216) (e3c29f0)
• cache-poisoning: report more zizmor findings and add a pedantic tier (#160) (c725459)
• cli: add --ruff, --show-doc-urls, --finding-context, platform forgejo and jujutsu roots (#215) (8e31c5c)
• cli: add shell completions and --explain RULE (#204) (b3b09d3)
• cli: add the options select, no-ignores and list-rules (#200) (dca5092)
• cli: show only the findings on what changed since a revision (--changed-since) (#274) (ea0ac90)
• command-injection: report input that a script runs as code after it moved to env (#202) (ebeeb6f)
• comment-trigger-authorization: report comment-triggered jobs that do not check who commented (pedantic) (#217) (60fa75e)
• concurrency-deadlock: report a group that a workflow shares with the workflow it calls (#210) (c41e2ad)
• concurrency-limits: report schedule-only and manual-only workflows (pedantic) (#266) (c1ec820)
• config: JSON Schemas for the config file and for --format json (#195) (5f83de6)
• dangerous-triggers: say what the token and the secrets can do, and make a workflow without privileges pedantic (#189) (97e79e7)
• deprecated-node-runtime: report a Node.js runtime that GitHub removed in the metadata of an action (pedantic) (#225) (84dd922)
• deprecated-node-runtime: report popular actions at majors that declare node20 (pedantic) (#230) (8a9fc95)
• deprecated-node-runtime: report the environment variables that chose the Node.js runtime (pedantic) (#234) (6531d87)
• environment-file-redirect: report writes to GITHUB_OUTPUT that lose the data (#184) (79cc5ef)
• event-name-never-received: report github.event_name compared with an event the workflow never receives (#214) (b3bfcc4)
• external-tools: say when shellcheck or pyflakes did not run (#188) (f7280e5)
• facts: export the events, permissions, concurrency and calls of a repository as versioned JSON (--export-facts) (#272) (881dde9)
• fail-fast-action-inputs: report actions that pass when nothing was produced (#196) (f856144)
• fix: say why more findings have no fix, add --show-fix-status and the fix prerequisites to --explain (#269) (7aa3187)
• gh-without-token: report the gh command without GH_TOKEN or GITHUB_TOKEN (#177) (1d997da)
• github-app: check two more token actions and cover local composite actions in dependabot-missing-actions-update (#229) (e5b620e)
• github-env: follow text that a script reads with gh and git (#218) (9d0a4bb)
• github-script-syntax: check the JavaScript of actions/github-script with node --check (#242) (f106562)
• hardcoded-registry-credentials: report credentials in plain text in the registries of dependabot.yml (#265) (765521c)
• macos-gnu-flags: report GNU-only options in run scripts of macOS jobs (pedantic) (#241) (871c07d)
• malformed-expression-delimiters: report ${ github.ref }, $ {{ x }} and {{ github.sha }} (#180) (e452449)
• missing-version-comment: report a hash pin without a version comment and add it with --online --fix (#232) (97767b4)
• multiline-plain-run: report a run folded into one line (#205) (f4e76c4)
• online: look up the actions of a GitHub Enterprise Server on github.com (#250) (d8a1280)
• online: report coverage and cache freshness outside SARIF (#166) (5fd779e)
• online: report the jobs whose environment has no required reviewers (#247) (6c13781)
• output-clobbering: report input with line breaks written to GITHUB_OUTPUT as a record (#212) (c992eef)
• permissions: report a job whose permissions are too narrow for its actions (#192) (07d78b7)
• ref-version-mismatch: fix the version comment (unsafe) and read ratchet comments (#227) (60842f7)
• release: publish wheels to PyPI with go-to-wheel (#277) (0440a3a)
• repojacking: report an action whose owner name anyone can register (#248) (3b62077)
• runner-label: accept the labels of hosted-runner providers (#199) (27e453c)
• runner-label: check runner labels built from a matrix value and text (#233) (b67bbd4)
• runner-label: warn ahead of the retirement of a runner label and name it afterwards (#182) (0c3756b)
• sarif: say why a finding with a fix has none in the log (#164) (7a2a509)
• self-hosted-runner: count the configured labels and runner groups, and say when a pull request reaches the runner (#194) (80c43f8)
• shell-syntax: report syntax errors in run scripts without shellcheck (#273) (31ee66e)
• shellcheck: read a shellcheckrc, extra arguments and optional checks from the config (#191) (4d02a46)
• superfluous-actions: resolve runs-on expressions the repository tells (#271) (22a3f8e)
• template-injection: report more free text of outsiders in the default profile (#173) (08afe4a)
• timeouts: report how long jobs really took in their latest runs (--suggest-timeouts) (#275) (033f615)
• ubuntu-slim: report what the single-CPU runner cannot run (#190) (51a5e7f)
• undefined-property: check the properties of github.event against the webhook payloads (#249) (81a1038)
• unlocked-install: model the lifecycle scripts and the release age of aube (pedantic) (#255) (f5dfab7)
• unlocked-install: report installs without a release-age cooldown (pedantic) (#201) (13779f6)
• unlocked-install: report npm, yarn and bun installs that run lifecycle scripts (pedantic) (#187) (ee74c67)
• unmatched-paths-filter: report paths filters that match no file of the repository (pedantic) (#238) (2baf2cb)
• unpinnable-action: report a hash-pinned action whose own dependencies are not pinned (#240) (3cc0ddb)
• unpinned-images: check docker run images in scripts, add per-image policies and image allow/deny lists (#211) (376b065)
• unpinned-images: pin container images to a digest with --online --fix=unsafe (#239) (2f63474)
• unpinned-uses: accept a ref which the Actions lock file pins to a commit (#228) (c702b7c)
• unpinned-uses: accept the tag of an immutable release under --online (#251) (c112760)
• unpinned-uses: name the most specific version tag in the comment of --online --fix (#224) (84dd5fc)
• unredacted-secrets: report values cut from a secret and printed by a script (pedantic) (#222) (c45a29f)
• untrusted-artifact: know more download actions and report a download of every artifact with the option pedantic (#219) (bc216f9)
• untrusted-checkout: count the actions that run the workspace, with the input that makes them do it (#213) (29fea2c)
• untrusted-checkout: cover issue_comment workflows that build a pull request (#206) (6b73b42)
• untrusted-checkout: follow a pull request revision through variables and script files (#159) (78813f4)
• untrusted-checkout: follow the head of a pull request into local reusable workflows and composite actions (#208) (29843f2)
• untrusted-checkout: honor the fork pull request protection of actions/checkout (#203) (1acb258)
• untrusted-checkout: report gates that hold at one moment in front of code that can change, and labels that last (#220) (09fc91e)
• use-trusted-publishing: report jobs that build, lack an environment or drop attestations (pedantic) (#209) (1c26e5f)
• workflow-call: check the calls of reusable workflows of other repositories with --online (#236) (89f2c75)
• workflow-secret-scope: job-level secrets, secrets passed to reusable workflows, and unused workflow_call secrets (#223) (e7a53ef)

Bug Fixes

• action-release-cooldown: use the clock of the linter so the docs check does not depend on today (#289) (1de90e2)
• action: check popular actions pinned to a full version or to a commit with a version comment (#174) (d324b7c)
• api: accept nil LinterOptions, print the rule ID in Error and PrettyPrint, correct API comments (#283) (e2d3304)
• changed-since: count shared findings once, keep ..foo inside the repository, refuse --export-facts (#279) (341ccb5)
• cli: align user-facing messages with the documented behavior (#287) (a6c8dd3)
• config: a missing file in "extends" of a discovered config file is an error (#285) (1a848ff)
• download-script: report a missing release, accept amd64, fix the help text (#282) (3165939)
• if-always-true: do not report the newlines at the end of a block scalar (#226) (871eb35)
• ignore: read own-line ignore directives from real YAML comments only (#284) (3f9e648)
• missing-timeout: add accept-step-timeouts for jobs whose steps all set timeout-minutes (#252) (10cfa99)
• multiline-plain-run: rename commandWords so the package builds again (#256) (24d8900)
• parser: accept a whole mapping or list written as one expression where the schema allows it (#178) (5689451)
• permissions: report the pedantic persona's permission findings (#176) (016f588)
• runner-label: follow the images behind the -latest labels (#171) (8e6159e)
• syntax: accept keys and values the workflow schema allows but the docs do not list (#170) (66df2e0)
• syntax: report what the runner rejects in schedules, merge_group, self-repository uses and action.yml (#186) (f498457)
• untrusted-checkout: follow pull/N/head fetches, skip merged pull requests, count sed -f, awk -f, tar -P and unzip -: (#175) (5fd975f)

Performance Improvements

• analyze each run script once and parse the callers of an action once (#270) (ac37b69)
• bound concurrent workflow checks to cut peak memory on huge repositories (#158) (bbe49da)
• online: read the advisories of all actions with one request (#268) (a04bcd2)
• share the parsed expressions of a string with the rules that still parsed them again (#165) (9bcdbb0)

---

This PR was generated with Release Please. See documentation.

---

Note

Low Risk
Mechanical version and changelog release with regenerated metadata; no application logic changes in the diff itself.

Overview
Release 2.2.0 bumps the project version from 2.1.0 to 2.2.0 via release-please: manifest, GitHub Action default version, pre-commit Docker hook tag, docs examples, and VitePress site version.

CHANGELOG.md gains the full 2.2.0 entry (2026-10-14), summarizing the release’s linter features (security/online rules, CLI flags like --changed-since and --export-facts, Actions lock linting, PyPI wheels), bug fixes, and performance work—those behaviors ship with the tag; this PR mainly records and pins the version.

Generated/metadata updates in the diff: event_payloads.go refreshes the GitHub OpenAPI source hash; popular_actions.go and popular_actions.json add dawidd6/action-download-artifact@v25 and dawidd6/action-send-mail@v22 (inputs/outputs and Node runtimes).

^{Reviewed by Cursor Bugbot for commit 4e4261b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords: 2

• chore: release
• chore(main): release

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: f74519ed-caa1-4d94-8eda-48b3b7025dfa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Low impact] This release update appears safe to merge.

Summary

Updates release metadata and version references to 2.2.0.

• jactionlint 2.2.0 is now the version used in setup defaults and guides.

_{Reviews (5) · Last reviewed commit: "chore(main): release 2.2.0" · Reviewed by Greptile}

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

[github-actions]

The generated files of this release PR were updated by this workflow run.

Output of the detection of new releases of popular actions (generate-popular-actions -d -w):

Detected some new releases
https://github.com/dawidd6/action-download-artifact/tree/v25
https://github.com/dawidd6/action-send-mail/tree/v22
Added to scripts/generate-popular-actions/popular_actions.json: dawidd6/action-download-artifact@v25
Added to scripts/generate-popular-actions/popular_actions.json: dawidd6/action-send-mail@v22

[jdx]

🤖 Created releases:

• v2.2.0

🌻