Does it run my workflow?

No. It statically parses and inspects the YAML; nothing is executed or uploaded.

Why does it warn about pull_request_target?

That trigger runs with repository secrets even for fork pull requests, so checking out and running untrusted PR code there can leak secrets.

Should I pin actions to a SHA?

For anything security sensitive, yes. Tags can be moved; a commit SHA cannot.

Is my data uploaded to a server?

No. This tool runs entirely in your browser using standard web APIs, so your input never leaves your device and nothing is logged or stored on our servers.

Does it work offline and on mobile?

Yes. Once the page has loaded it keeps working without a network connection, and the layout is responsive so it stays usable on phones and tablets.

GitHub Actions Workflow Validator

Validate a GitHub Actions workflow YAML and catch security and structure mistakes.

Support

Works Offline

Privacy First

No Login

No API

Workflow YAML

Paste the contents of .github/workflows/*.yml

Validation

Structure, dependency and security checks

Jobs

Steps

Problems

infoNo `permissions:` block — the workflow inherits repository defaults. Set an explicit least-privilege scope such as `contents: read`.

About the GitHub Actions Workflow Validator

Paste a .github/workflows file and get an instant review: YAML parsing, required keys (on, jobs, runs-on, steps), unknown trigger events, invalid job ids, broken needs: dependencies, unpinned or outdated actions, script-injection risks from untrusted github.event data, curl-pipe-to-shell steps and missing least-privilege permissions blocks. Everything runs in your browser.

Examples

Unpinned action

- uses: actions/checkout@master

Output

WARNING: pins a moving branch — pin a tag or SHA instead

Keyboard shortcuts

Copy the main outputCtrl / ⌘ + Shift + C
Download the resultCtrl / ⌘ + S
Share this toolCtrl / ⌘ + Shift + S
Reset the inputsAlt + R
Open the tool search paletteCtrl / ⌘ + K

Related tools

.editorconfig Generator

Dev Utilities

Create an .editorconfig file with per-language overrides.

.htaccess Redirect Generator

Dev Utilities

Generate Apache .htaccess redirect and rewrite rules.

Bash Alias Generator

Dev Utilities

Create shell aliases for Bash, Zsh or Fish with correct quoting.

Chmod Calculator

Dev Utilities

Unix permission calculator: checkboxes, octal, and symbolic.

Cron Expression Builder & Parser

Dev Utilities

Build, explain and preview cron schedules with timezone-aware next runs.

Crontab to Human Readable

Dev Utilities

Translate whole crontab files into plain English, line by line.

Frequently asked questions

Comments

No login needed. Comments appear after a quick review.

Loading comments…

Version 1.0.0 · Updated 2026-08-22 · Runs entirely in your browser