GitHub Actions YAML Validator
100% LocalValidate GitHub Actions workflow files for triggers, jobs, steps, and best practices.
Paste a GitHub Actions workflow YAML. The parser checks job structure, step syntax, and common mistakes.
Learn More
Configuration Mastery: Taming the YAML vs. JSON vs. TOML War
Cron Expression Syntax Explained (with 50 Examples) — 2026 Guide
Cron in Production: Avoiding Common Scheduled Task Failures
Scheduled tasks are the silent killers of production stability. Learn how to monitor cron jobs, handle daylight savings time, and prevent overlapping executions.
What is GitHub Actions YAML Validator?
Frequently Asked Questions
Technical Deep Dive
GitHub Actions YAML Validator
Validate GitHub Actions workflow JSON for correct structure. Checks the 'on' trigger section for valid event names, validates job definitions for required 'runs-on' and steps, detects pinning to '@master', missing operationId equivalents (operationId), undefined job dependencies, and timeout recommendations. Reports errors, warnings, and info.
Schema + expression checks
Validates workflow structure against the official schema and flags unknown keys, bad needs: graphs, and malformed [object Object] expressions.
Common-mistake hints
Catches missing permissions:, pull_request_target misuse, and steps that reference an undefined job output.
No repo access
Paste the YAML — the tool never connects to GitHub or reads your repository.
01 Workflow Validation Ruleset
| Validation Check | Severity Level | Failure Impact |
|---|---|---|
Missing runs-on | Error | Runner allocation failure; job crashes |
Undefined needs Job | Error | Dependent job is silently skipped |
| Action Pinned to Branch | Warning | High supply-chain vulnerability risk |
Missing permissions | Warning | Token defaults to broad read-all access |
02 Continuous Integration Security Model
permissions: {} at the root level, explicitly granting per-job scopes like id-token: write only when needed.
uses: steps to strict 40-character SHAs, mitigating against compromised maintainer accounts altering mutable tags.
timeout-minutes on every job, overriding the default 6-hour kill threshold to protect billing limits.