Skip to content

Category

CI/CD tools.

Validate and harden your pipeline configuration before it runs.

CI/CD tools

When you reach for CI/CD tools.

Pipeline configuration is code that only runs in production. There is no local execution, no type checker, and the feedback loop is a push, a wait, and a red X — which is why the average workflow accumulates a long tail of things that look right and are not.

The GitHub Actions expression footgun is the canonical example. Write if: ${{ github.event_name }} == 'push' and the runner substitutes the value, leaves the comparison as literal text, and evaluates a non-empty string — which is truthy. The step runs on every event. It has never once done what it looks like it does, and it has been an open issue since 2021.

These validate the YAML, flag the security misconfigurations linters usually skip, and — for expressions specifically — tell you the actual value GitHub would compute, using GitHub's coercion rules rather than JavaScript's.