actionlint coverage scope

[pygarap]

I would love to know which audit rules and lint checks covered by actionlint, that zizmor doesn't cover, are planned to be covered by zizmor in the future, and which audit rules and lint checks from actionlint will never be considered within the project's scope.

[woodruffw]

I can't find where I wrote it before, but the TL;DR is that zizmor is focused on security checks only, not general correctness/well-formedness checks (although some of those happen by "accident" as part of us parsing inputs for analysis).

So, anything that actionlint does that has some security salience is potentially in scope. But things that just flag footguns e.g. when pushing invalid syntax aren't.