GitHub Actions Workflow Validator

It validates workflow structure (required name/on/jobs keys), trigger event names, job fields (runs-on, steps), needs: dependency references (catching undefined jobs), action version pinning, hardcoded secrets, schedule cron expressions, and security issues like pull_request_target with untrusted head SHA.

This tool focuses on structural correctness — does your workflow have the required fields, are job dependencies valid, are event names spelled correctly? A linter additionally checks style and best practices. Both are complementary: validate structure first, then lint for best practices.

Pinning to @main or @master uses whatever code is on that branch at run time — including potentially malicious changes (supply chain attacks). Pinning to @v4 or a commit SHA (e.g., @abc1234) makes your workflow reproducible and immune to upstream branch changes.

Common triggers: push, pull_request, pull_request_target, schedule (cron), workflow_dispatch (manual trigger), workflow_call (reusable workflows), release, issues, issue_comment, create, delete, fork, label, milestone, repository_dispatch, discussion, merge_group, and more. Invalid event names silently fail to trigger.

The needs: field creates job dependencies — a job with needs: [test, build] only runs after both succeed. If you reference a job name that doesn't exist in the workflow, GitHub will refuse to run it. This validator catches those broken references before you push.

No. All validation runs entirely in your browser using JavaScript. Your workflow YAML never leaves your machine — safe even when your workflows contain secret names, internal endpoint URLs, or repository structure details.