Comment utiliser : GitHub Actions Workflow Validator
- Paste a workflow file, open it, or load the sample.
- YAML errors are shown first, with line numbers.
- Then triggers, jobs, steps,
needs, expressions, cron schedules and permissions are checked. - Best-practice checks flag outdated action versions, unpinned third-party actions, missing timeouts and script-injection risks.
Common workflow mistakes this catches
- Unknown events or keys — typos such as
pull-requestinstead ofpull_request, orrun-oninstead ofruns-on. - Broken job graphs —
needspointing at a job that doesn’t exist, or jobs that depend on each other in a cycle. - Steps with both or neither of
usesandrun, andusesreferences without a version (@v4). - Expressions — unbalanced
${{ }}, unknown contexts and references to step outputs that don’t exist. - Invalid cron — schedules must have five fields; the tool explains when they run (in UTC).
- Deprecated commands such as
::set-outputand::save-state, replaced by$GITHUB_OUTPUTand$GITHUB_STATE.
Security checks
Using ${{ github.event.pull_request.title }}, issue bodies or branch names directly inside run: lets anyone who opens a pull request inject shell commands. Pass them through an environment variable instead. The validator also flags pull_request_target combined with checking out PR code, missing permissions (the token then gets broad defaults) and third-party actions pinned to a mutable tag rather than a commit SHA.
Create a new workflow with the GitHub Actions generator, explain schedules with the cron expression generator and check other YAML with the YAML validator.
Aussi recherché comme : github actions validator, github actions linter, validate github workflow, actionlint online, github workflow yaml checker, github actions syntax check.
Outils complémentaires : GitHub Actions Workflow Validator
- Kubernetes YAML Validator — Paste Deployments, Services, Ingresses, ConfigMaps or a whole multi-document file.
- Git Cheat Sheet — Every Git command you use day to day — and the ones you need when something goes wrong — explained in one line.
- Kubernetes YAML Generator — Fill in your app’s name, image and port and get production-ready Kubernetes YAML: a Deployment with probes, resource limits and a hardened security context, plus the Service, Ingress with TLS, ConfigMap, Secret and HorizontalPodAutoscaler you tick — in one file ready for kubectl apply.
- systemd Service Generator — Run your app as a proper Linux service that starts on boot and restarts when it crashes.
Questions fréquentes
Is this the same as actionlint?
It covers many of the same checks — syntax, job graph, expressions, cron, deprecated commands and injection risks — and runs in your browser with nothing to install. For CI enforcement, run actionlint in your pipeline as well.
Does it validate reusable workflows and composite actions?
Workflows with
on: workflow_call and jobs that call reusable workflows (uses: at job level) are supported. action.yml files for composite actions are not checked yet.Why pin actions to a commit SHA?
Tags like
@v4 can be moved by the action’s owner — or an attacker who compromises it. A full commit SHA can’t change, so your workflow runs exactly the code you reviewed.Puis-je installer GitHub Actions Workflow Validator en tant qu’application web et l’utiliser hors ligne ?
Oui. GitHub Actions Workflow Validator est une application web installable (PWA) : elle s’installe depuis votre navigateur, sans passer par une boutique d’applications. Cliquez sur « Installer l’application » en haut de cette page dans Chrome ou Edge (Windows, macOS, Linux, ChromeOS) ; sur Android, utilisez « Partager » → « Ajouter à l’écran d’accueil » sur iPhone et iPad ; ou « Fichier » → « Ajouter au Dock » dans Safari 17+ sur Mac. L’application s’ouvre alors dans sa propre fenêtre avec sa propre icône, et comme elle s’exécute entièrement dans votre navigateur, elle continue de fonctionner hors ligne. Firefox sur ordinateur de bureau ne permet pas d’installer d’applications web. Comment fonctionne l’installation.