# GitHub Actions workflow checker

- Human page: https://happytails.ai/en/developer-tools/github-actions-workflow-checker/
- Markdown: https://happytails.ai/en/developer-tools/github-actions-workflow-checker.md
- Structured JSON: https://happytails.ai/agents/en/developer-tools/github-actions-workflow-checker/index.json
- Visibility: public

## Tool capabilities

| Property | Value |
| --- | --- |
| Tool ID | `github-actions-workflow-checker` |
| Category | developer-tools |
| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |
| Browser execution | Use the visible action or interactive controls. |
| Browser processing | Browser; see tool notes for network behavior. |
| HTTP API | Not callable through HTTP. |
| Browser-agent interface | run_current_tool |

### Implementation notes

Checks a GitHub Actions workflow on your device. Up to 500,000 characters; expressions are read as text and never run.

### Inputs and settings

Text input: Workflow YAML.

Example or placeholder shown in the interface (not a validated fixture):

```text
on: push
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
```

Paste one workflow file from .github/workflows. Up to 500,000 characters. Review the settings before running.

No additional settings are declared for this tool.

### Browser-agent workflow

1. Open the human page in a browser that supports WebMCP.
2. Discover the interface exposed by that page; use its actual schema.
3. Select files on the page first when the tool requires files.
4. Call `run_current_tool` with valid input and settings.
5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.

Calls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.

### Planning specification

Up to 500,000 characters in one workflow file, 500 jobs and 5,000 steps. Everything runs on your device in a background worker. Downloads: JSON report, CSV findings and SARIF 2.1.0.

This describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.

### Complete machine-readable capability record

```json
{
  "id": "github-actions-workflow-checker",
  "category": "developer-tools",
  "built": true,
  "requirements": "Up to 500,000 characters in one workflow file, 500 jobs and 5,000 steps. Everything runs on your device in a background worker. Downloads: JSON report, CSV findings and SARIF 2.1.0.",
  "implementation": {
    "fields": [],
    "registrationFamily": "config-yaml-manifests",
    "inputMaxLength": 500000,
    "inputErrorCode": "CONFIG_YAML_MANIFESTS_TOO_LONG_WORKFLOW",
    "note": "Checks a GitHub Actions workflow on your device. Up to 500,000 characters; expressions are read as text and never run.",
    "experience": {
      "automatic": false,
      "single": false,
      "inputMaxLength": 500000,
      "inputMode": "text",
      "label": "Workflow YAML",
      "placeholder": "on: push\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4",
      "help": "Paste one workflow file from .github/workflows. Up to 500,000 characters. Review the settings before running.",
      "action": null
    },
    "mode": "explicit",
    "interactive": false
  },
  "execution": "Browser interface",
  "api": null,
  "browser_agent": {
    "supported": true,
    "name": "run_current_tool",
    "discovery": "WebMCP on the human page in a supporting browser",
    "verification": "See audit/API-AUDIT.md; availability is not verification"
  }
}
```

## Page guide

Find broken needs references, job output typos, unsafe token permissions, unpinned actions and script injection risks in a GitHub Actions workflow before you push it.

### How to use GitHub Actions workflow checker

1. Paste one workflow file from .github/workflows.
2. Run the check.
3. Review each finding with its line and rule.
4. Download the JSON report, CSV or SARIF file for code scanning.

How can we improve this tool?

Report a problem or share an idea.

Please leave out private information. Your message and the tool name go to our team via PostHog.

## Useful next steps

- [YAML validator](https://happytails.ai/en/developer-tools/yaml-validator/) ([Markdown](https://happytails.ai/en/developer-tools/yaml-validator.md))

- [Cron parser](https://happytails.ai/en/developer-tools/cron-parser/) ([Markdown](https://happytails.ai/en/developer-tools/cron-parser.md))

- [YAML duplicate key checker](https://happytails.ai/en/data-tools/yaml-duplicate-key-checker/) ([Markdown](https://happytails.ai/en/data-tools/yaml-duplicate-key-checker.md))

## What is checked

Happytails.ai reads the workflow with the rules in the GitHub Docs pages "Workflow syntax for GitHub Actions", "Events that trigger workflows", "Controlling permissions for GITHUB\_TOKEN" and "Security hardening for GitHub Actions" (docs.github.com, read on 16 October 2026). It checks top-level, job and step keys, trigger names, the needs graph for unknown jobs and cycles, needs and steps references in expressions, and matrix sizes over 256 jobs.

### Security rules

The checker warns when no permissions are set, when write-all is used, when a third-party action is not pinned to a full commit SHA, and when a run script inserts text that someone outside the repository controls, such as an issue title. A pull\_request\_target workflow that checks out the pull request head is reported as an error.

### Limits

Expressions are read as text and never evaluated, so values built at run time are not followed. Inputs of reusable workflows and called actions are not checked, and the lists of keys, events and permission scopes are authored from the documentation, so a brand new key shows as a warning.