Does it run my workflow?

No. It statically parses and inspects the YAML; nothing is executed or uploaded.

Why does it warn about pull_request_target?

That trigger runs with repository secrets even for fork pull requests, so checking out and running untrusted PR code there can leak secrets.

Should I pin actions to a SHA?

For anything security sensitive, yes. Tags can be moved; a commit SHA cannot.

Is my data uploaded to a server?

No. This tool runs entirely in your browser using standard web APIs, so your input never leaves your device and nothing is logged or stored on our servers.

Does it work offline and on mobile?

Yes. Once the page has loaded it keeps working without a network connection, and the layout is responsive so it stays usable on phones and tablets.

GitHub Actions Workflow Validator

Validate a GitHub Actions workflow YAML and catch security and structure mistakes.

Support

Works Offline

Privacy First

No Login

No API

Workflow YAML

Paste the contents of .github/workflows/*.yml

Validation

Structure, dependency and security checks

Jobs

Steps

Problems

infoNo `permissions:` block — the workflow inherits repository defaults. Set an explicit least-privilege scope such as `contents: read`.

About the GitHub Actions Workflow Validator

Paste a .github/workflows file and get an instant review: YAML parsing, required keys (on, jobs, runs-on, steps), unknown trigger events, invalid job ids, broken needs: dependencies, unpinned or outdated actions, script-injection risks from untrusted github.event data, curl-pipe-to-shell steps and missing least-privilege permissions blocks. Everything runs in your browser.

Popular uses

github actions validator
workflow yaml validator
github actions linter
ci yaml checker
actions security

Examples

Unpinned action

- uses: actions/checkout@master

Output

YAMLWARNING: pins a moving branch — pin a tag or SHA instead

Keyboard shortcuts

Copy the main outputCtrl / ⌘ + Shift + C
Download the resultCtrl / ⌘ + S
Share this toolCtrl / ⌘ + Shift + S
Reset the inputsAlt + R
Open the tool search paletteCtrl / ⌘ + K

Related tools

Docker Compose Generator

Dev Utilities

Build a valid docker-compose.yml from a simple service form.

Docker Compose Validator

Dev Utilities

Check docker-compose.yml for errors, bad ports and risky settings.

Dockerfile Linter

Dev Utilities

Lint a Dockerfile for common best-practice issues.

Kubernetes YAML Validator

Dev Utilities

Validate Kubernetes manifests and catch risky container settings.

Nginx Config Analyzer

Dev Utilities

Analyse nginx.conf for syntax, security and performance issues.

Systemd Service File Generator

Dev Utilities

Build a production-ready systemd .service unit file.

Works well with

Next steps from other categories.

YAML Formatter

Converters

Beautify and normalize YAML with a hand-written parser.

All Dev Utilities tools

Frequently asked questions

How to explore, edit and map a source project in your browser
A practical guide to opening a source archive, tracing dependencies, inspecting syntax trees and exporting edited files without uploading a repository.

Version 1.0.0 · Updated 2026-08-22 · Runs entirely in your browser

GitHub Actions Workflow Validator

About the GitHub Actions Workflow Validator

Popular uses

Examples

Keyboard shortcuts

Related tools

Docker Compose Generator

Docker Compose Validator

Dockerfile Linter

Kubernetes YAML Validator

Nginx Config Analyzer

Systemd Service File Generator

Works well with

YAML Formatter

Frequently asked questions

Does it run my workflow?

Why does it warn about pull_request_target?

Should I pin actions to a SHA?

Is my data uploaded to a server?

Does it work offline and on mobile?

Read more