GitHub Actions Workflow Validator
Lint GitHub Actions workflows with actionlint and catch risky permissions and refs
Workflow YAML
0 B · 0 lines · validates as you type
Results
Paste or upload a workflow to start.
What does this validator check?
It runs actionlint 1.7.12, the open-source GitHub Actions linter, compiled to WebAssembly. actionlint checks workflow syntax, expression types, job needs, action inputs for popular actions, reusable workflow calls, cron schedules, runner labels and shell names. CodingTool adds a small set of security checks: write-all and broad write permissions, missing top-level permissions, pull_request_target with a PR head checkout, mutable action refs, persisted checkout credentials and echoed secrets.
How to use
- 1.Paste a workflow from .github/workflows, upload a .yml or .yaml file, or load an example.
- 2.Validation runs as you type. The first run downloads the actionlint engine (about 10 MB) once.
- 3.Review Findings: actionlint diagnostics first, then security checks. Click a line number to jump to it in the editor.
- 4.Open Parsed Workflow for triggers, jobs, execution order, permissions and action references, or Raw for JSON.
- 5.Copy the findings as Markdown for an issue, pull request or AI prompt.
Privacy
Your workflow is processed in your browser. actionlint runs in a Web Worker and the workflow is not uploaded, stored or added to the URL. Only the actionlint engine file is downloaded from CodingTool.
Limitations
The WebAssembly build cannot run shellcheck or pyflakes, so shell script and Python lint findings are not included. Local actions and reusable workflows referenced with ./ are not read from your repository. Security checks are heuristics, not a full audit: a clean result does not prove a workflow is safe. actionlint messages are shown in English as the engine reports them.
