chore: Cherry-picked changes from upstream

.github/workflows/dockerless.yml

@@ -0,0 +1,87 @@
+name: reviewdog
+on: [pull_request]
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+  issues: write
+
+jobs:
+  actionlint:
+    name: runner / actionlint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: actionlint
+        uses: ./dockerless/
+        with:
+          tool_name: dockerless actionlint
+
+  reviewdog:
+    name: runner / reviewdog
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ github.actor == 'dependabot[bot]' && fromJSON('["ubuntu-26.04"]') || fromJSON('["ubuntu-slim", "ubuntu-26.04", "ubuntu-26.04-arm", "macos-latest", "windows-latest", "windows-11-arm"]') }}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: actionlint w/ reviewdog
+        uses: ./dockerless/
+        with:
+          actionlint_flags: examples/broken-workflow.yml
+          tool_name: dockerless reviewdog on ${{ matrix.os }}
+          level: info
+
+  shellcheck:
+    name: runner / shellcheck
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ github.actor == 'dependabot[bot]' && fromJSON('["ubuntu-26.04"]') || fromJSON('["ubuntu-slim", "ubuntu-26.04", "ubuntu-26.04-arm", "macos-latest", "windows-latest", "windows-11-arm"]') }}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: actionlint w/ shellcheck
+        uses: ./dockerless/
+        with:
+          actionlint_flags: examples/shellcheck.yml
+          tool_name: dockerless shellcheck on ${{ matrix.os }}
+          level: info
+
+  pyflakes:
+    name: runner / pyflakes
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ github.actor == 'dependabot[bot]' && fromJSON('["ubuntu-26.04"]') || fromJSON('["ubuntu-slim", "ubuntu-26.04", "ubuntu-26.04-arm", "macos-latest", "windows-latest", "windows-11-arm"]') }}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: actionlint w/ pyflakes
+        uses: ./dockerless/
+        with:
+          actionlint_flags: examples/pyflakes.yml
+          tool_name: dockerless pyflakes on ${{ matrix.os }}
+          level: info

.github/workflows/reviewdog.yml

@@ -17,56 +17,71 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: actionlint
         uses: ./
         with:
           tool_name: actionlint
 
   reviewdog:
     name: runner / reviewdog
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ github.actor == 'dependabot[bot]' && fromJSON('["ubuntu-26.04"]') || fromJSON('["ubuntu-26.04", "ubuntu-26.04-arm"]') }}
+    runs-on: ${{ matrix.os }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: actionlint w/ reviewdog
         uses: ./
         with:
           actionlint_flags: examples/broken-workflow.yml
-          tool_name: reviewdog
+          tool_name: reviewdog on ${{ matrix.os }}
+          level: info
 
   shellcheck:
     name: runner / shellcheck
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ github.actor == 'dependabot[bot]' && fromJSON('["ubuntu-26.04"]') || fromJSON('["ubuntu-26.04", "ubuntu-26.04-arm"]') }}
+    runs-on: ${{ matrix.os }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: actionlint w/ shellcheck
         uses: ./
         with:
           actionlint_flags: examples/shellcheck.yml
-          tool_name: shellcheck
+          tool_name: shellcheck on ${{ matrix.os }}
+          level: info
 
   pyflakes:
     name: runner / pyflakes
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ github.actor == 'dependabot[bot]' && fromJSON('["ubuntu-26.04"]') || fromJSON('["ubuntu-26.04", "ubuntu-26.04-arm"]') }}
+    runs-on: ${{ matrix.os }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: actionlint w/ pyflakes
         uses: ./
         with:
           actionlint_flags: examples/pyflakes.yml
-          tool_name: pyflakes
+          tool_name: pyflakes on ${{ matrix.os }}
+          level: info

Dockerfile

@@ -1,51 +1,21 @@
-# Single base image as requested
-FROM golang:1.25-alpine3.23@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced
-
-# Versions
-ENV SHELLCHECK_VERSION=v0.11.0 \
-    REVIEWDOG_VERSION=v0.21.0 \
-    ACTIONLINT_VERSION=v1.7.12
-
-# System deps: build tools, git, curl, wget, xz for .tar.xz, python & pip
-RUN set -eux; \
-    apk add --no-cache \
-      git curl wget xz \
-      build-base \
-      python3 py3-pyflakes \
-      jq
-
-# Install ShellCheck (prebuilt tarball matching arch)
-RUN set -eux; \
-    arch="$(uname -m)"; \
-    echo "arch is ${arch}"; \
-    if [ "${arch}" = "armv7l" ]; then arch='armv6hf'; fi; \
-    url_base='https://github.com/koalaman/shellcheck/releases/download'; \
-    tar_file="${SHELLCHECK_VERSION}/shellcheck-${SHELLCHECK_VERSION}.linux.${arch}.tar.xz"; \
-    wget -q "${url_base}/${tar_file}" -O - | tar xJf -; \
-    mv "shellcheck-${SHELLCHECK_VERSION}/shellcheck" /usr/local/bin/; \
-    rm -rf "shellcheck-${SHELLCHECK_VERSION}"; \
-    /usr/local/bin/shellcheck --version
-
-# Build reviewdog from exact tag
-RUN set -eux; \
-    git clone --depth 1 --branch "${REVIEWDOG_VERSION}" https://github.com/reviewdog/reviewdog.git /tmp/reviewdog; \
-    cd /tmp/reviewdog; \
-    go mod edit -require=golang.org/x/crypto@v0.45.0; \
-    go mod edit -require=golang.org/x/oauth2@v0.27.0 || true; \
-    go mod tidy; \
-    go build -trimpath -ldflags "-s -w" -o /usr/local/bin/reviewdog ./cmd/reviewdog; \
-    /usr/local/bin/reviewdog -version || true; \
-    rm -rf /tmp/reviewdog
-
-# Build actionlint from exact tag
-RUN set -eux; \
-    git clone --depth 1 --branch "${ACTIONLINT_VERSION}" https://github.com/rhysd/actionlint.git /tmp/actionlint; \
-    cd /tmp/actionlint; \
-    go build -trimpath -ldflags "-s -w" -o /usr/local/bin/actionlint ./cmd/actionlint; \
-    /usr/local/bin/actionlint --version; \
-    rm -rf /tmp/actionlint
-
-# Add entrypoint
+FROM python:3.14.7-alpine3.24@sha256:f2186fc449b8f7aa5897b542777427a21dc77864f271cf4d1646361cf681c2b9
+
+RUN apk --no-cache add git curl bash
+
+COPY scripts scripts
+
+# install pyflakes
+RUN ./scripts/install-pyflakes.sh
+
+# install shellcheck
+RUN ./scripts/install-shellcheck.sh
+
+# install actionlint
+RUN OSTYPE=linux-gnu ./scripts/install-actionlint.sh
+
+# install reviewdog
+RUN ./scripts/install-reviewdog.sh
+
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 

README.md

@@ -15,17 +15,37 @@ code review experience.
 
 ## Example usages
 
+### Docker-based (default)
+
 ```yaml
 name: reviewdog
 on: [pull_request]
 jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: step-security/action-actionlint@v1
 ```
 
+### Dockerless
+
+If you prefer to run without Docker, a dockerless version is also available:
+
+```yaml
+name: reviewdog
+on: [pull_request]
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: step-security/action-actionlint/dockerless@v1
+```
+
+The dockerless version directly installs actionlint and reviewdog on the runner without using Docker.
+This can be useful in environments where Docker is not available.
+
 ## Inputs
 
 ### `github_token`

action.yml

@@ -1,57 +1,57 @@
-name: 'actionlint with reviewdog'
-description: 'run actionlint with reviewdog'
-author: 'step-security'
+name: "actionlint with reviewdog"
+description: "run actionlint with reviewdog"
+author: "step-security"
 inputs:
   github_token:
-    description: 'GITHUB_TOKEN.'
-    default: '${{ github.token }}'
+    description: "GITHUB_TOKEN."
+    default: "${{ github.token }}"
     required: true
   tool_name:
-    description: 'Tool name to use for reviewdog reporter'
-    default: 'actionlint'
+    description: "Tool name to use for reviewdog reporter"
+    default: "actionlint"
     required: true
   level:
-    description: 'Report level for reviewdog [info,warning,error]'
-    default: 'error'
+    description: "Report level for reviewdog [info,warning,error]"
+    default: "error"
     required: true
   reporter:
     description: |
       Reporter of reviewdog command [github-pr-check,github-pr-review,github-check].
       Default is github-pr-check.
       github-pr-review can use Markdown and add a link to rule page in reviewdog reports.
-    default: 'github-pr-check'
+    default: "github-pr-check"
     required: true
   filter_mode:
     description: |
       Filtering mode for the reviewdog command [added,diff_context,file,nofilter].
       Default is file.
-    default: 'file'
+    default: "file"
     required: true
   fail_level:
     description: |
       If set to `none`, always use exit code 0 for reviewdog. Otherwise, exit code 1 for reviewdog if it finds at least 1 issue with severity greater than or equal to the given level.
       Possible values: [none,any,info,warning,error]
       Default is `none`.
-    default: 'none'
+    default: "none"
   fail_on_error:
     description: |
       Deprecated, use `fail_level` instead.
       Exit code for reviewdog when errors are found [true,false]
       Default is `false`.
     deprecationMessage: Deprecated, use `fail_level` instead.
-    default: 'false'
+    default: "false"
     required: true
   reviewdog_flags:
-    description: 'Additional reviewdog flags'
-    default: ''
+    description: "Additional reviewdog flags"
+    default: ""
     required: false
   actionlint_flags:
-    description: 'Additional actionlint flags'
-    default: ''
+    description: "Additional actionlint flags"
+    default: ""
     required: false
 runs:
-  using: 'docker'
-  image: 'docker://ghcr.io/step-security/action-actionlint:v1.72.0@sha256:7f6f21f88720f33a61bc714ee7dc6243defcb2f2ae0697bb582e6769825612ae' #v1.72.0
+  using: "docker"
+  image: "docker://ghcr.io/step-security/action-actionlint:v1.72.0@sha256:7f6f21f88720f33a61bc714ee7dc6243defcb2f2ae0697bb582e6769825612ae" #v1.72.0
   entrypoint: /entrypoint.sh
 branding:
   color: red