Catch workflow errors and security holes before you push.

Two things at once. First, it parses your workflow YAML and reports syntax errors, bad indentation, and structural mistakes — the things that make a run fail before a single step executes. Second, and more importantly, it runs a set of security-misconfiguration checks that ordinary linters skip: the pull_request_target + checkout “pwn request” pattern, script injection through untrusted ${{ github.* }} expressions, third-party actions pinned to a mutable tag instead of a commit SHA, and over-broad permissions such as write-all. You get errors and dangerous patterns in one pass.

No. The validator runs 100% client-side. Your workflow YAML is parsed and analysed inside your browser tab — nothing is uploaded to a server, and there is no account or signup. You can safely paste internal or proprietary workflows, including ones with secret names and private runner labels.

actionlint is excellent at syntax, expression typing, and shellcheck integration — and you should keep using it. But the mistakes that actually get repositories compromised are security ones: running untrusted code with a privileged token, interpolating attacker-controlled text straight into a shell, or pulling a third-party action by a tag that its author can silently move. This tool focuses on those security misconfigurations, validates the YAML too, and needs nothing installed.

A workflow triggered by pull_request_target runs in the context of the base repository — with access to its secrets and a read/write GITHUB_TOKEN — but it can be triggered by a pull request from any fork. If that workflow also checks out the PR head (actions/checkout with the PR ref) and then builds, tests, or runs scripts from it, an attacker's fork code executes with your secrets. That is the classic “pwn request”. The validator flags pull_request_target whenever it is paired with a checkout of untrusted PR code.

When you embed an expression like ${{ github.event.issue.title }} or ${{ github.head_ref }} directly inside a run: shell block, GitHub substitutes the raw, attacker-controllable value into your script before the shell parses it. A title of a"; rm -rf / # becomes executable. The fix is to pass untrusted values through an env: variable and reference them as "$TITLE" so the shell treats them as data, never code. The validator flags untrusted github context expressions used inside run steps.

A reference like actions/checkout@v4 or some-org/action@main points at a tag or branch that the action's maintainer — or an attacker who compromises their account — can move to new code at any time, and that code runs in your pipeline with your token. Pinning to a full 40-character commit SHA (uses: actions/checkout@<sha>) makes the version immutable. The validator flags third-party actions pinned to a mutable tag or branch.

No. This validator is an independent, community tool and is not affiliated with, endorsed by, or sponsored by GitHub, Inc. “GitHub” and “GitHub Actions” are used here only descriptively, to identify the workflow format the tool checks.

Paste the workflow YAML into a browser-based validator to catch errors before committing — no install and no push needed. This tool runs the full check set (YAML structure plus security misconfigurations) entirely in your browser, so you get instant feedback on syntax errors, missing runs-on, bad trigger names, and dangerous patterns like unpinned actions or script injection before the workflow ever reaches GitHub.

Frequent issues include a missing runs-on on a job, a step that specifies both uses and run, a needs reference pointing at a job that does not exist, an invalid trigger event name, and bad YAML indentation. The validator catches each of these as structural errors with the line number where the problem occurs, so you can fix them before the run fails on GitHub.

Most static checkers — actionlint, zizmor, action-validator — require a CLI or a Rust/Go toolchain. This validator is free, needs no install or signup, and runs entirely in your browser. It checks both YAML validity and the security misconfigurations (unpinned actions, template injection, dangerous triggers, over-broad token permissions) that the CLI tools cover, without any local setup.