actionlint-kjanat-git

LOW

maintainer kjanat 0 votes scanned 2026-09-05 16:00:23.828148

View on AUR

Why flagged

The package builds from a public Git repository with a SKIP'd checksum, but it is a transparent VCS build of a legitimate fork; the source is not a prebuilt binary or obfuscated payload, and the worst-case risk is limited to supply-chain issues in the upstream code.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public Git repository with a SKIP'd checksum, but it is a transparent VCS build of a legitimate fork; the source is not a prebuilt binary or obfuscated payload, and the worst-case risk is limited to supply-chain issues in the upstream code.

PKGBUILD

      1# Maintainer: Kaj Kowalski <info@kajkowalski.nl>
    
      2
    
      3# VCS package: builds the tip of master. pkgver() derives the version from
    
      4# git describe at build time; the value below only feeds the AUR web page.
    
      5pkgname=actionlint-kjanat-git
    
      6pkgver=1.14.0.r21.gde29823
    
      7pkgrel=1
    
      8pkgdesc='Static checker for GitHub Actions workflow files (kjanat fork, git master)'
    
      9arch=('x86_64' 'aarch64' 'armv7h')
    
      10url='https://actionlint.kjanat.dev'
    
      11license=('MIT')
    
      12depends=('glibc')
    
      13makedepends=('git' 'go' 'pandoc-cli')
    
      14optdepends=(
    
      15	'shellcheck: check shell scripts in run steps'
    
      16	'python-pyflakes: check Python scripts in run steps'
    
      17)
    
      18provides=("actionlint=$pkgver")
    
      19conflicts=('actionlint' 'actionlint-bin' 'actionlint-git' 'actionlint-kjanat' 'actionlint-kjanat-bin')
    
      20source=('actionlint::git+https://github.com/kjanat/actionlint.git')
    
      21sha256sums=('SKIP')
    
      22
    
      23# Go module path; the ldflags targets below are package-level vars in it.
    
      24_module='actionlint.kjanat.dev'
    
      25
    
      26pkgver() {
    
      27	cd actionlint
    
      28	# v1.14.0-12-gabc1234 -> 1.14.0.r12.gabc1234
    
      29	git describe --long --abbrev=7 --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      30}
    
      31
    
      32prepare() {
    
      33	cd actionlint
    
      34	go mod download
    
      35}
    
      36
    
      37build() {
    
      38	cd actionlint
    
      39	export CGO_CPPFLAGS="${CPPFLAGS}"
    
      40	export CGO_CFLAGS="${CFLAGS}"
    
      41	export CGO_CXXFLAGS="${CXXFLAGS}"
    
      42	export CGO_LDFLAGS="${LDFLAGS}"
    
      43	# A second -ldflags on the command line replaces GOFLAGS' wholesale, so
    
      44	# -linkmode=external is passed here and not through GOFLAGS.
    
      45	export GOFLAGS='-buildmode=pie -trimpath -mod=readonly -modcacherw'
    
      46	# makepkg strips symbols itself; keeping them here lets debuginfod work.
    
      47	go build -o build/actionlint \
    
      48		-ldflags "-linkmode=external -X ${_module}.version=$pkgver -X ${_module}.installedFrom=https://aur.archlinux.org/packages/$pkgname" \
    
      49		./cmd/actionlint
    
      50	make man/actionlint.1
    
      51}
    
      52
    
      53check() {
    
      54	cd actionlint
    
      55	# The ./scripts/... tests reach the network; the shellcheck and pyflakes
    
      56	# integration tests self-skip when those tools are absent.
    
      57	go test . ./cmd/...
    
      58}
    
      59
    
      60package() {
    
      61	cd actionlint
    
      62	install -Dm0755 build/actionlint "$pkgdir/usr/bin/actionlint"
    
      63	install -Dm0644 LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE.txt"
    
      64	install -Dm0644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      65	install -Dm0644 -t "$pkgdir/usr/share/doc/$pkgname/" docs/*.md
    
      66	install -Dm0644 man/actionlint.1 "$pkgdir/usr/share/man/man1/actionlint.1"
    
      67
    
      68	# The binary was just built for $CARCH, so it can generate its own completions.
    
      69	install -dm0755 "$pkgdir/usr/share/bash-completion/completions" \
    
      70		"$pkgdir/usr/share/zsh/site-functions" \
    
      71		"$pkgdir/usr/share/fish/vendor_completions.d" \
    
      72		"$pkgdir/usr/share/actionlint"
    
      73	build/actionlint -completion bash >"$pkgdir/usr/share/bash-completion/completions/actionlint"
    
      74	build/actionlint -completion zsh >"$pkgdir/usr/share/zsh/site-functions/_actionlint"
    
      75	build/actionlint -completion fish >"$pkgdir/usr/share/fish/vendor_completions.d/actionlint.fish"
    
      76	# pwsh users dot-source this from their $PROFILE; Linux has no autoload dir for it.
    
      77	build/actionlint -completion powershell >"$pkgdir/usr/share/actionlint/actionlint.ps1"
    
      78	chmod 0644 "$pkgdir/usr/share/bash-completion/completions/actionlint" \
    
      79		"$pkgdir/usr/share/zsh/site-functions/_actionlint" \
    
      80		"$pkgdir/usr/share/fish/vendor_completions.d/actionlint.fish" \
    
      81		"$pkgdir/usr/share/actionlint/actionlint.ps1"
    
      82}
    
      83

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-05 16:00:23	Low	2