GitHub Actions Validator
Validate GitHub Actions workflows: structure, job dependencies, unpinned actions, script injection and permissions. Free and private: runs in your browser.
Paste a workflow YAML to catch errors before you push and wait for the run to fail.
Runs entirely in your browser. Nothing you paste is uploaded or stored.
Use cases
- Find a syntax error before the build or deploy fails.
- Check config files in code review.
- Learn the rules your linter enforces.
Frequently asked questions
Why pin actions to a commit SHA?
Tags like @v4 can be moved. Pinning to a full SHA guarantees the code that runs is the code you reviewed, which matters for supply-chain security.
Is the GitHub Actions Validator free?
Yes. It is free with no sign-up, and it runs entirely in your browser, so your input is never uploaded or stored.
What should I do with the issues it reports?
Fix high-severity items first; they usually break builds or deployments. Lower-severity items are style and best-practice suggestions.
Related tools
Checking one snippet is a start. Scan your whole repository for free with CodeInspector.