Cómo usar: GitHub Actions Workflow Validator
- Paste a workflow file, open it, or load the sample.
- YAML errors are shown first, with line numbers.
- Then triggers, jobs, steps,
needs, expressions, cron schedules and permissions are checked. - Best-practice checks flag outdated action versions, unpinned third-party actions, missing timeouts and script-injection risks.
Common workflow mistakes this catches
- Unknown events or keys — typos such as
pull-requestinstead ofpull_request, orrun-oninstead ofruns-on. - Broken job graphs —
needspointing at a job that doesn’t exist, or jobs that depend on each other in a cycle. - Steps with both or neither of
usesandrun, andusesreferences without a version (@v4). - Expressions — unbalanced
${{ }}, unknown contexts and references to step outputs that don’t exist. - Invalid cron — schedules must have five fields; the tool explains when they run (in UTC).
- Deprecated commands such as
::set-outputand::save-state, replaced by$GITHUB_OUTPUTand$GITHUB_STATE.
Security checks
Using ${{ github.event.pull_request.title }}, issue bodies or branch names directly inside run: lets anyone who opens a pull request inject shell commands. Pass them through an environment variable instead. The validator also flags pull_request_target combined with checking out PR code, missing permissions (the token then gets broad defaults) and third-party actions pinned to a mutable tag rather than a commit SHA.
Create a new workflow with the GitHub Actions generator, explain schedules with the cron expression generator and check other YAML with the YAML validator.
También se busca como: github actions validator, github actions linter, validate github workflow, actionlint online, github workflow yaml checker, github actions syntax check.
Herramientas que combinan con: GitHub Actions Workflow Validator
- Kubernetes YAML Validator — Paste Deployments, Services, Ingresses, ConfigMaps or a whole multi-document file.
- Git Cheat Sheet — Every Git command you use day to day — and the ones you need when something goes wrong — explained in one line.
- Kubernetes YAML Generator — Fill in your app’s name, image and port and get production-ready Kubernetes YAML: a Deployment with probes, resource limits and a hardened security context, plus the Service, Ingress with TLS, ConfigMap, Secret and HorizontalPodAutoscaler you tick — in one file ready for kubectl apply.
- systemd Service Generator — Run your app as a proper Linux service that starts on boot and restarts when it crashes.
Preguntas frecuentes
Is this the same as actionlint?
It covers many of the same checks — syntax, job graph, expressions, cron, deprecated commands and injection risks — and runs in your browser with nothing to install. For CI enforcement, run actionlint in your pipeline as well.
Does it validate reusable workflows and composite actions?
Workflows with
on: workflow_call and jobs that call reusable workflows (uses: at job level) are supported. action.yml files for composite actions are not checked yet.Why pin actions to a commit SHA?
Tags like
@v4 can be moved by the action’s owner — or an attacker who compromises it. A full commit SHA can’t change, so your workflow runs exactly the code you reviewed.¿Puedo instalar GitHub Actions Workflow Validator como aplicación web y utilizarla sin conexión?
Sí. GitHub Actions Workflow Validator es una aplicación web instalable (PWA): se instala desde el navegador, no se descarga desde una tienda de aplicaciones. Haz clic en «Instalar aplicación» en la parte superior de esta página en Chrome o Edge (Windows, macOS, Linux, ChromeOS) o, en Android, utiliza «Compartir» → «Añadir a la pantalla de inicio» en iPhone y iPad, o «Archivo» → «Añadir al Dock» en Safari 17+ en un Mac. A continuación, se abrirá en su propia ventana con su propio icono y, como se ejecuta íntegramente en tu navegador, seguirá funcionando sin conexión. Firefox en el ordenador de sobremesa no permite instalar aplicaciones web. Cómo funciona la instalación.