happytails.ai

GitHub Actions workflow checker

Open GitHub Actions workflow checker on Happytails.ai. This view has the same page content and links, with explicit tool capabilities. Read the processing notes before using a tool.

Tool capabilities

{
  "id": "github-actions-workflow-checker",
  "category": "developer-tools",
  "built": true,
  "requirements": "Up to 500,000 characters in one workflow file, 500 jobs and 5,000 steps. Everything runs on your device in a background worker. Downloads: JSON report, CSV findings and SARIF 2.1.0.",
  "implementation": {
    "fields": [],
    "registrationFamily": "config-yaml-manifests",
    "inputMaxLength": 500000,
    "inputErrorCode": "CONFIG_YAML_MANIFESTS_TOO_LONG_WORKFLOW",
    "note": "Checks a GitHub Actions workflow on your device. Up to 500,000 characters; expressions are read as text and never run.",
    "experience": {
      "automatic": false,
      "single": false,
      "inputMaxLength": 500000,
      "inputMode": "text",
      "label": "Workflow YAML",
      "placeholder": "on: push\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4",
      "help": "Paste one workflow file from .github/workflows. Up to 500,000 characters. Review the settings before running.",
      "helpParts": [
        "Paste one workflow file from .github/workflows.",
        "Up to 500,000 characters.",
        "Review the settings before running."
      ],
      "action": null
    },
    "mode": "explicit",
    "interactive": false
  },
  "execution": "Browser interface",
  "api": null,
  "browser_agent": {
    "supported": true,
    "name": "run_current_tool",
    "discovery": "WebMCP on the human page in a supporting browser",
    "verification": "See audit/API-AUDIT.md; availability is not verification"
  }
}

Page guide

Find broken needs references, job output typos, unsafe token permissions, unpinned actions and script injection risks in a GitHub Actions workflow before you push it.

How to use GitHub Actions workflow checker
  1. Paste one workflow file from .github/workflows.
  2. Run the check.
  3. Review each finding with its line and rule.
  4. Download the JSON report, CSV or SARIF file for code scanning.

Useful next steps

YAML validatorCron parserYAML duplicate key checker

What is checked

Happytails.ai reads the workflow with the rules in the GitHub Docs pages "Workflow syntax for GitHub Actions", "Events that trigger workflows", "Controlling permissions for GITHUB_TOKEN" and "Security hardening for GitHub Actions" (docs.github.com, read on 16 October 2026). It checks top-level, job and step keys, trigger names, the needs graph for unknown jobs and cycles, needs and steps references in expressions, and matrix sizes over 256 jobs.

Security rules

The checker warns when no permissions are set, when write-all is used, when a third-party action is not pinned to a full commit SHA, and when a run script inserts text that someone outside the repository controls, such as an issue title. A pull_request_target workflow that checks out the pull request head is reported as an error.

Limits

Expressions are read as text and never evaluated, so values built at run time are not followed. Inputs of reusable workflows and called actions are not checked, and the lists of keys, events and permission scopes are authored from the documentation, so a brand new key shows as a warning.