Como usar: GitHub Actions Workflow Validator
- Paste a workflow file, open it, or load the sample.
- YAML errors are shown first, with line numbers.
- Then triggers, jobs, steps,
needs, expressions, cron schedules and permissions are checked. - Best-practice checks flag outdated action versions, unpinned third-party actions, missing timeouts and script-injection risks.
Common workflow mistakes this catches
- Unknown events or keys — typos such as
pull-requestinstead ofpull_request, orrun-oninstead ofruns-on. - Broken job graphs —
needspointing at a job that doesn’t exist, or jobs that depend on each other in a cycle. - Steps with both or neither of
usesandrun, andusesreferences without a version (@v4). - Expressions — unbalanced
${{ }}, unknown contexts and references to step outputs that don’t exist. - Invalid cron — schedules must have five fields; the tool explains when they run (in UTC).
- Deprecated commands such as
::set-outputand::save-state, replaced by$GITHUB_OUTPUTand$GITHUB_STATE.
Security checks
Using ${{ github.event.pull_request.title }}, issue bodies or branch names directly inside run: lets anyone who opens a pull request inject shell commands. Pass them through an environment variable instead. The validator also flags pull_request_target combined with checking out PR code, missing permissions (the token then gets broad defaults) and third-party actions pinned to a mutable tag rather than a commit SHA.
Create a new workflow with the GitHub Actions generator, explain schedules with the cron expression generator and check other YAML with the YAML validator.
Também pesquisado como: github actions validator, github actions linter, validate github workflow, actionlint online, github workflow yaml checker, github actions syntax check.
Ferramentas que combinam com: GitHub Actions Workflow Validator
- Kubernetes YAML Validator — Paste Deployments, Services, Ingresses, ConfigMaps or a whole multi-document file.
- Git Cheat Sheet — Every Git command you use day to day — and the ones you need when something goes wrong — explained in one line.
- Kubernetes YAML Generator — Fill in your app’s name, image and port and get production-ready Kubernetes YAML: a Deployment with probes, resource limits and a hardened security context, plus the Service, Ingress with TLS, ConfigMap, Secret and HorizontalPodAutoscaler you tick — in one file ready for kubectl apply.
- systemd Service Generator — Run your app as a proper Linux service that starts on boot and restarts when it crashes.
Perguntas frequentes
Is this the same as actionlint?
It covers many of the same checks — syntax, job graph, expressions, cron, deprecated commands and injection risks — and runs in your browser with nothing to install. For CI enforcement, run actionlint in your pipeline as well.
Does it validate reusable workflows and composite actions?
Workflows with
on: workflow_call and jobs that call reusable workflows (uses: at job level) are supported. action.yml files for composite actions are not checked yet.Why pin actions to a commit SHA?
Tags like
@v4 can be moved by the action’s owner — or an attacker who compromises it. A full commit SHA can’t change, so your workflow runs exactly the code you reviewed.Posso instalar o GitHub Actions Workflow Validator como um aplicativo da web e usá-lo offline?
Sim. O GitHub Actions Workflow Validator é um aplicativo da web instalável (PWA) — instalado a partir do seu navegador, não baixado de uma loja de aplicativos. Clique em “Instalar aplicativo” na parte superior desta página no Chrome ou no Edge (Windows, macOS, Linux, ChromeOS) ou, no Android, use “Compartilhar” → “Adicionar à tela inicial” no iPhone e no iPad, ou “Arquivo” → “Adicionar ao Dock” no Safari 17+ em um Mac. Em seguida, ela se abre em uma janela própria com seu próprio ícone e, como é executada inteiramente no seu navegador, continua funcionando offline. O Firefox no desktop não permite a instalação de aplicativos da web. Como funciona a instalação.