日本語English

GitHub Actions Studio

Paste a workflow YAML to see its triggers (on), its jobs in needs order, and the uses and run of each step. It flags places where a value anyone can write is expanded straight into run (script injection), actions pinned to a tag or branch, and jobs without permissions, each with a line number. It does not fully validate the schema or run the workflow.

On-device・No uploadMobile friendlyWorks offline

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

Pasted YAML is processed only inside your browser. It is not sent to a server or stored. Full schema validation and running are not performed. Findings follow GitHub’s official documentation.

Drop a workflow YAML file

or

One text file up to 200 KB. Contents are not uploaded.Paste (Ctrl+V) also works
Paste a workflow YAML or drop a file to see the jobs, steps and findings.

How to use

  1. ci.yml

    Paste the YAML (.yml)

  2. Jobs and stepswith line numbers

    Job dependencies and findings

  3. actions-review.txtnot uploaded

    Save the findings as a list

Paste a workflow, check the dependencies and findings, then fix the lines that need it

  1. Paste a workflow YAML (a .yml under .github/workflows), or drop the file. “Try a sample” shows how it works.

  2. In the jobs and steps list, check on, the needs order, runs-on and the matrix combination count.

  3. In the steps list, check the uses (action) and the first line of run for each step.

  4. Open “Issues” for the list by severity. Injection with pull_request_target is high, unpinned third-party actions are medium, and the rest are low.

  5. Copy or save the issue list.

What it does

Script injection detection

Flags, with line numbers, places in run and in the script of github-script where a value anyone can write (such as github.event.issue.title) is expanded directly in an expression.

Unpinned action findings

Lists actions whose uses version is a tag or branch. Third-party actions are medium; official actions and github are low (for attention). Actions pinned to a full commit SHA are not flagged.

pull_request_target and checkout

With the pull_request_target trigger, flags a checkout of the PR head with actions/checkout as high.

needs dependencies and matrix counts

Orders the jobs by needs, and flags needs that point to missing jobs and cycles. The matrix count is the product of its arrays.

Permission and timeout checks

Flags jobs without permissions, write-all, and jobs without timeout-minutes.

Use cases

  • Check before merging that a PR title or comment is not written straight into run
  • Decide whether a third-party action should be pinned to a full SHA instead of a tag
  • See the default permissions of a workflow that omits permissions, before rewriting it
  • Check the needs order and the matrix combination count without tracing them by hand

Capability matrix

FeatureSupportNotes
Reading on (triggers), jobs and stepsSupported—
needs order, cycles and missing jobsSupported—
uses versions (tag, branch, SHA) and docker:// digestsSupported—
Script injection, printing secrets, pull_request_target with checkoutPartialChecks only known context names and common forms. Other injection forms are not found
permissions, timeout-minutes and expression parenthesesSupported—
Full schema validation (every key name and type)Not supportedNot performed. Only unknown top-level keys are flagged
Running the workflow, fetching actions, network requestsNot supportedNo network requests. The code of uses actions is not read
Expanding reusable workflowsNot supportedThe called workflow is not read

Limits & notes

  • Input is limited to 200,000 characters and 100 jobs. Anything beyond is not read, and you are told.
  • Full schema validation is not performed. A misspelled key or wrong type may not be flagged, but GitHub may still reject the workflow.
  • matrix counts only the product of its arrays. include and exclude are not counted, and an expression matrix cannot be counted.
  • Findings follow GitHub’s official documentation only. Recommendations may change over time.

Privacy & safety

Pasted YAML is processed only inside your browser. Nothing is sent to or stored on a server, and nothing is saved in the browser. Usage analytics never include content or file names.

FAQ

What is dangerous about pull_request_target?
Even for a PR from a fork, pull_request_target runs in the context of the base branch and can access the repository secrets. If you check out the PR head and run it there, untrusted code runs where the secrets are available. This tool flags that combination as high.
Should uses be pinned to a SHA?
A third-party action can be pointed at different code later by changing its tag or main. Pinning to a full commit SHA keeps the code you reviewed. GitHub’s official documentation also recommends pinning to a SHA.
What should permissions contain?
Only the permissions the job needs, starting from read (for example contents: read). If you omit it, the default token permissions apply, and those defaults can differ by repository setting.
How is this different from a YAML checker?
General YAML syntax can be checked with the YAML and TOML studio. This tool focuses on GitHub Actions items (triggers, needs, uses and expressions) and on security findings.
Can this tool run the workflow?
No. It does not run the workflow or fetch actions. Use a local runner, or check it on GitHub.

YAML / TOML Studio — Validate, Format & Convert

Paste YAML, TOML or JSON to validate, format or convert it. Errors show the exact line and column, and type traps such as “no becomes false” and anything lost in conversion are flagged up front. Your data never leaves your device.

No upload

Dockerfile Studio

Paste a Dockerfile to check its syntax, stages and common mistakes. Secret-looking values and points to confirm, such as curl | sh, are listed with line numbers. You can also format it or generate starter files for Node.js, Python, Go, a static site or Java. Nothing is built, and your input never leaves your device.

No upload

Kubernetes Manifest Studio

Paste Deployment, Service or other manifests to list the resources and see which Deployment a Service's selector reaches. It flags removed apiVersions, latest or missing image tags, missing requests and limits, and risky securityContext settings, each with a line number. It does not fully validate the schema, so use it as a review aid before you apply anything to a cluster.

No upload

Lockfile Diff & Dependency Tree

Compare two lockfiles to see which packages were added, removed or upgraded. You can also see why a package is installed and where several versions of one package come from. Nothing leaves your browser.

No upload

Docker Compose Studio

Convert docker run commands to compose.yaml, or compose.yaml back to docker run. A compose file is checked for syntax, the Compose Specification and common mistakes, and security points worth confirming are listed. Nothing is started or pulled, and your input never leaves your device.

No upload

.env Studio

Paste or drop a .env file to see its keys and values in a table, with duplicates, empty values and syntax problems flagged by line. Values are hidden by default. You can compare a .env with a .env.example, or export an example file, JSON or a Kubernetes Secret. It checks common dotenv syntax, not tool-specific rules such as docker compose variable expansion.

No upload

Last updated: