GitHub Actions Workflow Validator

Common workflow mistakes this catches

• Unknown events or keys — typos such as pull-request instead of pull_request, or run-on instead of runs-on.
• Broken job graphs — needs pointing at a job that doesn’t exist, or jobs that depend on each other in a cycle.
• Steps with both or neither of uses and run, and uses references without a version (@v4).
• Expressions — unbalanced ${{ }}, unknown contexts and references to step outputs that don’t exist.
• Invalid cron — schedules must have five fields; the tool explains when they run (in UTC).
• Deprecated commands such as ::set-output and ::save-state, replaced by $GITHUB_OUTPUT and $GITHUB_STATE.

Security checks

Using ${{ github.event.pull_request.title }}, issue bodies or branch names directly inside run: lets anyone who opens a pull request inject shell commands. Pass them through an environment variable instead. The validator also flags pull_request_target combined with checking out PR code, missing permissions (the token then gets broad defaults) and third-party actions pinned to a mutable tag rather than a commit SHA.

Create a new workflow with the GitHub Actions generator, explain schedules with the cron expression generator and check other YAML with the YAML validator.

Tools that pair well with the GitHub Actions Workflow Validator

• Kubernetes YAML Validator — Paste Deployments, Services, Ingresses, ConfigMaps or a whole multi-document file.
• Git Cheat Sheet — Every Git command you use day to day — and the ones you need when something goes wrong — explained in one line.
• .gitignore Generator — Tick your stack — Node, Python, React, Next.js, Docker, macOS, VS Code and 40 more — and get one clean, de-duplicated .gitignore with commented sections, ready to download.
• Git Command Generator — Pick a task like “undo the last commit but keep my changes” or “rename a branch on GitHub”, fill in your branch names and get the exact Git commands — each line explained, risky steps flagged.