diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1e637eca2d..db57e628ea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,6 +31,11 @@ jobs:
       - name: Spellcheck
         run: npm run check:spelling
 
+      - name: Lint GitHub Actions
+        uses: docker://rhysd/actionlint:latest
+        with:
+          args: -color
+
   checkForCommonlyIgnoredFiles:
     name: Check for commonly ignored files
     runs-on: ubuntu-latest
diff --git a/.github/workflows/cmd-publish-pr-on-npm.yml b/.github/workflows/cmd-publish-pr-on-npm.yml
index 6c8b587436..12a0e513c1 100644
--- a/.github/workflows/cmd-publish-pr-on-npm.yml
+++ b/.github/workflows/cmd-publish-pr-on-npm.yml
@@ -3,10 +3,12 @@ on:
   workflow_call:
     inputs:
       pullRequestJSON:
+        description: String that contain JSON payload for `pull_request` event.
         required: true
         type: string
     secrets:
       NPM_CANARY_PR_PUBLISH_TOKEN:
+        description: NPM token to publish canary release.
         required: true
 jobs:
   build-npm-dist:
diff --git a/.github/workflows/cmd-run-benchmark.yml b/.github/workflows/cmd-run-benchmark.yml
index 12909d9351..6e3cc9cb9c 100644
--- a/.github/workflows/cmd-run-benchmark.yml
+++ b/.github/workflows/cmd-run-benchmark.yml
@@ -3,6 +3,7 @@ on:
   workflow_call:
     inputs:
       pullRequestJSON:
+        description: String that contain JSON payload for `pull_request` event.
         required: true
         type: string
 jobs:
@@ -19,7 +20,7 @@ jobs:
       - name: Deepen cloned repo
         env:
           BASE_SHA: ${{ fromJSON(inputs.pullRequestJSON).base.sha }}
-        run: 'git fetch --depth=1 origin $BASE_SHA:refs/tags/BASE'
+        run: 'git fetch --depth=1 origin "$BASE_SHA:refs/tags/BASE"'
 
       - name: Setup Node.js
         uses: actions/setup-node@v2
diff --git a/.github/workflows/deploy-artifact-as-branch.yml b/.github/workflows/deploy-artifact-as-branch.yml
index 4d11caa0f5..2dc71e7fcb 100644
--- a/.github/workflows/deploy-artifact-as-branch.yml
+++ b/.github/workflows/deploy-artifact-as-branch.yml
@@ -3,15 +3,19 @@ on:
   workflow_call:
     inputs:
       environment:
+        description: Environment to publish under
         required: true
         type: string
       artifact_name:
+        description: Artifact name
         required: true
         type: string
       target_branch:
+        description: Target branch
         required: true
         type: string
       commit_message:
+        description: Commit message
         required: true
         type: string
 jobs:
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index d9ea7bb82b..d71e6fb4b9 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -16,7 +16,7 @@ jobs:
       - name: Deepen cloned repo
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: 'git fetch --depth=1 origin $BASE_SHA:refs/tags/BASE'
+        run: 'git fetch --depth=1 origin "$BASE_SHA:refs/tags/BASE"'
 
       - name: Setup Node.js
         uses: actions/setup-node@v2