Validate GitHub Actions workflow YAML, job dependencies, triggers, permissions, and common CI/CD security issues.
Inspect workflow YAML for structural issues, dependency problems, and common CI/CD security risks.
Load a sample workflow to try the validator.
Your support helps us build more tools and improve the ones you already use.
More tools you may find useful.
Create, edit, understand, and validate Unix cron expressions while viewing upcoming scheduled execution times.
Validate Kubernetes YAML manifests for syntax and common structural issues before applying resources to a Kubernetes cluster.
Validate .env files, detect duplicate variables, check variable names and identify common environment configuration issues.
Analyze AWS IAM policies for wildcard permissions, overly broad access, potentially risky actions, and common policy configuration issues.
The GitHub Actions Workflow Validator helps you inspect CI/CD workflow YAML before committing it to your repository. Paste your workflow or upload a .yml or .yaml file to check YAML syntax, required workflow structure, job dependencies, step definitions, and selected security concerns. Analysis runs locally in your browser without connecting to GitHub.
The validator parses your YAML and checks for common workflow configuration issues. It looks for missing workflow triggers, missing or empty jobs, missing runners, invalid step definitions, and references to undefined job dependencies.
It also flags selected security concerns, including broad workflow permissions, mutable action references such as @main, and potentially risky pull_request_target configurations. These findings are recommendations for review rather than proof that a workflow is vulnerable.
No. This tool analyzes the workflow in your browser. It does not require a GitHub login, repository access, or a server connection to perform its built-in checks.
The validator does not execute workflows, download action metadata, or guarantee that a workflow will run successfully. Use GitHub's own validation and test runs to confirm compatibility with the GitHub Actions environment.
It is a tool that checks GitHub Actions workflow YAML for syntax errors, common structural problems, job dependency issues, and selected security concerns before you commit the file.
Paste the contents of your workflow file into the editor or upload a .yml or .yaml file, then select Validate workflow. Review the reported errors and warnings and correct the configuration as needed.
No. You can paste or upload the workflow directly. The built-in analysis runs in your browser and does not need a GitHub account or repository connection.
No. It performs static checks for common issues but does not execute jobs, verify runner availability, fetch action metadata, or test every GitHub Actions expression. A successful result does not guarantee a successful workflow run.
Errors identify syntax or configuration issues that should be corrected. Warnings highlight settings that deserve review, such as broad permissions or mutable action references. Some findings require context and may not indicate a real problem in every workflow.