See all checks, the GitHub docs on workflow syntax, contexts and security hardening.
The playground lints with the default profile, except that a few rules every minimal example would break (missing-timeout, missing-permissions, unpinned-uses and a few more, see the contributing guide) are off. It has no network, so the online checks are not available. Use the command line for the full set of rules and the other profiles.