5 of 5 free conversions left. Sign in for unlimited use.
GitHub Actions Workflow Validator
Paste a workflow from .github/workflows to catch YAML errors, unknown events and bad cron schedules, jobs without runs-on or steps, steps with both or neither of uses and run, needs mistakes, references to steps, needs or matrix values that do not exist, always-true if conditions, retired runners, old action versions and untrusted event data used inside scripts. It reports only and never rewrites your file; it does not read action metadata, so use actionlint in CI for the strictest check.
About the GitHub Actions Workflow Validator
The GitHub Actions Workflow Validator checks a workflow file for what most often stops it from running or makes it unsafe: YAML errors and duplicate keys, unknown events and invalid cron schedules, jobs without runs-on or steps, steps with both or neither of uses and run, needs that point nowhere or loop, references to steps, needs and matrix values that do not exist, always-true if conditions, retired runner images, old action versions and untrusted event data pasted into run scripts.
How to use the GitHub Actions Workflow Validator
- Paste your workflow YAML (the contents of a file in .github/workflows).
- Click Validate.
- Fix the errors, then review the warnings and suggestions in the findings table.
Frequently asked questions
Does it replace actionlint?
No. It does not download action metadata, so it cannot check the inputs of the actions you use, and it only follows the expression contexts it was written for. It reports problems and never rewrites your file. Keep actionlint in CI as the stricter check.
Which security problems does it look for?
Event data such as an issue title, pull request title or branch name used directly inside a run script (script injection), pull_request_target workflows that check out the pull request's own code, write-all permissions, actions that follow a moving branch, and deprecated workflow commands such as ::set-output.
Are my data stored when I use the GitHub Actions Workflow Validator?
The text you submit is processed in memory to produce the result and is not saved. Like any web server, Code Converter logs basic visit data (page, IP address and browser) but never the content you paste. Even so, use placeholder values instead of real production credentials.
Is the GitHub Actions Workflow Validator free, and can I call it from a script?
It is free and only needs a free account (log in first). The same tool is available as a REST endpoint at POST /api/github-actions-validator; see the API documentation for the fields and examples.