GitHub Actions Validator
Validate GitHub Actions workflow YAML — syntax, required fields, deprecated actions, job dependencies, and context expressions
About this tool
The GitHub Actions Validator checks a workflow YAML file against the GitHub Actions schema and common best practices. It catches syntax problems, missing required fields (on, jobs, runs-on), invalid needs references, circular dependencies, and more than 25 deprecated action versions.
Useful during CI/CD setup or troubleshooting when a workflow fails to trigger, a job hangs, or you are upgrading an older repository. The tool points directly at the field and line that needs attention.
Example: a workflow that uses actions/checkout@v2 and actions/setup-node@v1 will report both as deprecated with the recommended replacement versions. A job with needs: [nonexistent] is flagged as an error.
Toggle strict mode to also require a workflow name and validate concurrency group presence — off by default so legacy workflows do not drown in noise.
FAQ
Does this validate every possible GitHub Actions workflow feature? ›
It covers the most common issues: required fields (on, jobs, runs-on), deprecated actions and runners, invalid needs references, circular dependencies, missing step commands, and suspicious context expressions. Niche features like reusable workflows, composite actions, or OIDC configuration are not exhaustively checked — the focus is on errors that block execution.
Why does it flag pinned SHA references? ›
Pinning to a commit SHA (e.g. actions/checkout@a1b2c3d) is the most secure approach because it prevents supply-chain attacks, but it makes version upgrades manual. The tool notes this as info — it is not an error. Tag-based pins (e.g. @v4) are easier to keep current.
How is circular dependency detection done? ›
The tool walks the needs graph for each job. If a job transitively depends on itself, a circular dependency error is reported. GitHub Actions itself rejects workflows with cycles, so fixing them before push saves time.
What YAML features are supported? ›
The parser handles nested mappings, arrays (dash lists), quoted strings, multi-line strings (|, >), flow mappings, and flow sequences — everything commonly used in GitHub Actions workflows. YAML anchors and aliases are not supported.