depmedic / compare / ci-doctor vs actionlint

ci-doctor vs actionlint

actionlint is the gold standard for syntactic and shell-safety checks on GitHub Actions workflow files. ci-doctor is the cost-and-reliability-first audit. They are complementary - most teams should run both.

tl;dr   Run both. We do, on every depmedic repo. actionlint for correctness, ci-doctor for cost and reliability. They take ~6 ms each on a typical repo.

Where actionlint wins

  • Detects YAML and expression syntax errors (typos in ${{ steps.x.outputs.y }}, missing needs: references).
  • Runs shellcheck against every run: block automatically.
  • Catches glob mistakes in paths: filters that ci-doctor does not parse.
  • Mature: 7+ years of releases, used by GitHub itself in tutorials.
  • Single-binary Go install, fastest startup time.

Where ci-doctor wins

  • 14 cost / security / reliability rules that actionlint does not have (missing-concurrency, missing-timeout, missing-cache, stale-cache-key, fail-fast-true, expensive-runner, etc.).
  • Auto-fix mode: npx ci-doctor --fix applies four safe fixes in place. actionlint is read-only.
  • Pairs with gha-budget for $-denominated cost numbers per workflow.
  • SARIF output for GitHub Code Scanning works the same as actionlint, with severity per rule.
  • Pure JavaScript - zero install with npx ci-doctor; no compile step.

Where they overlap

They overlap on roughly two checks: both flag deprecated workflow commands (::set-output) and both notice missing permissions: blocks. Otherwise, the rule sets are disjoint.

Run them side by side

This is the answer for most teams. Both finish in seconds:

# correctness
curl -sSfL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash | bash
./actionlint
# cost + reliability
npx ci-doctor

Try ci-doctor in 6 ms

Zero install, zero config:

# 14-rule audit of every workflow under .github/workflows/
npx ci-doctor

# auto-apply the four safe fixes
npx ci-doctor --fix

# SARIF for GitHub Code Scanning
npx ci-doctor --sarif > results.sarif
View on npm   All 14 rules explained

Want the long-form patterns?

The Cut Your CI Bill cookbook is 30 paste-ready GitHub Actions patterns plus 5 hardened workflow templates - the why behind every default ci-doctor enforces. $19, one-time, MIT-licensed templates.

Get the cookbook   5 free preview patterns

About this comparison

Written 2026-04-27 by the maintainer of ci-doctor. actionlint on GitHub for upstream documentation. If anything here is incorrect or outdated, open an issue at depmedicdev-byte/ci-doctor/issues and I will fix it. We do not pay for placement and we do not accept paid placement.

Other comparisons: vs super-linter · vs MegaLinter · vs octoscan