GitHub Actions workflow checker
Find broken needs references, job output typos, unsafe token permissions, unpinned actions and script injection risks in a GitHub Actions workflow before you push it.
Up to 500,000 characters in one workflow file, 500 jobs and 5,000 steps. Everything runs on your device in a background worker. Downloads: JSON report, CSV findings and SARIF 2.1.0. Paste one workflow file from .github/workflows. Up to 500,000 characters. Review the settings before running.
Your result
How to use GitHub Actions workflow checker
- Paste one workflow file from .github/workflows.
- Run the check.
- Review each finding with its line and rule.
- Download the JSON report, CSV or SARIF file for code scanning.
Useful next steps
What is checked
Happytails.ai reads the workflow with the rules in the GitHub Docs pages "Workflow syntax for GitHub Actions", "Events that trigger workflows", "Controlling permissions for GITHUB_TOKEN" and "Security hardening for GitHub Actions" (docs.github.com, read on 16 October 2026). It checks top-level, job and step keys, trigger names, the needs graph for unknown jobs and cycles, needs and steps references in expressions, and matrix sizes over 256 jobs.
Security rules
The checker warns when no permissions are set, when write-all is used, when a third-party action is not pinned to a full commit SHA, and when a run script inserts text that someone outside the repository controls, such as an issue title. A pull_request_target workflow that checks out the pull request head is reported as an error.
Limits
Expressions are read as text and never evaluated, so values built at run time are not followed. Inputs of reusable workflows and called actions are not checked, and the lists of keys, events and permission scopes are authored from the documentation, so a brand new key shows as a warning.