So nutzt du: GitHub Actions Workflow Validator
- Paste a workflow file, open it, or load the sample.
- YAML errors are shown first, with line numbers.
- Then triggers, jobs, steps,
needs, expressions, cron schedules and permissions are checked. - Best-practice checks flag outdated action versions, unpinned third-party actions, missing timeouts and script-injection risks.
Common workflow mistakes this catches
- Unknown events or keys — typos such as
pull-requestinstead ofpull_request, orrun-oninstead ofruns-on. - Broken job graphs —
needspointing at a job that doesn’t exist, or jobs that depend on each other in a cycle. - Steps with both or neither of
usesandrun, andusesreferences without a version (@v4). - Expressions — unbalanced
${{ }}, unknown contexts and references to step outputs that don’t exist. - Invalid cron — schedules must have five fields; the tool explains when they run (in UTC).
- Deprecated commands such as
::set-outputand::save-state, replaced by$GITHUB_OUTPUTand$GITHUB_STATE.
Security checks
Using ${{ github.event.pull_request.title }}, issue bodies or branch names directly inside run: lets anyone who opens a pull request inject shell commands. Pass them through an environment variable instead. The validator also flags pull_request_target combined with checking out PR code, missing permissions (the token then gets broad defaults) and third-party actions pinned to a mutable tag rather than a commit SHA.
Create a new workflow with the GitHub Actions generator, explain schedules with the cron expression generator and check other YAML with the YAML validator.
Auch gesucht als: github actions validator, github actions linter, validate github workflow, actionlint online, github workflow yaml checker, github actions syntax check.
Passende Tools zu: GitHub Actions Workflow Validator
- Kubernetes YAML Validator — Paste Deployments, Services, Ingresses, ConfigMaps or a whole multi-document file.
- Git Cheat Sheet — Every Git command you use day to day — and the ones you need when something goes wrong — explained in one line.
- Kubernetes YAML Generator — Fill in your app’s name, image and port and get production-ready Kubernetes YAML: a Deployment with probes, resource limits and a hardened security context, plus the Service, Ingress with TLS, ConfigMap, Secret and HorizontalPodAutoscaler you tick — in one file ready for kubectl apply.
- systemd Service Generator — Run your app as a proper Linux service that starts on boot and restarts when it crashes.
Häufige Fragen
Is this the same as actionlint?
It covers many of the same checks — syntax, job graph, expressions, cron, deprecated commands and injection risks — and runs in your browser with nothing to install. For CI enforcement, run actionlint in your pipeline as well.
Does it validate reusable workflows and composite actions?
Workflows with
on: workflow_call and jobs that call reusable workflows (uses: at job level) are supported. action.yml files for composite actions are not checked yet.Why pin actions to a commit SHA?
Tags like
@v4 can be moved by the action’s owner — or an attacker who compromises it. A full commit SHA can’t change, so your workflow runs exactly the code you reviewed.Kann ich GitHub Actions Workflow Validator als Web-App installieren und offline nutzen?
Ja. GitHub Actions Workflow Validator ist eine installierbare Web-App (PWA) – sie wird über Ihren Browser installiert und nicht aus einem App-Store heruntergeladen. Klicken Sie oben auf dieser Seite in Chrome oder Edge (Windows, macOS, Linux, ChromeOS) auf „App installieren“ oder verwenden Sie auf Android-Geräten „Teilen“ → „Zum Startbildschirm hinzufügen“ auf dem iPhone und iPad bzw. „Datei“ → „Zum Dock hinzufügen“ in Safari 17+ auf einem Mac. Die App öffnet sich dann in einem eigenen Fenster mit einem eigenen Symbol, und da sie vollständig in Ihrem Browser ausgeführt wird, funktioniert sie auch offline. Firefox auf dem Desktop kann keine Web-Apps installieren. So funktioniert die Installation.