# GitHub Actions Studio

Paste a workflow YAML to see its triggers (on), its jobs in needs order, and the uses and run of each step. It flags places where a value anyone can write is expanded straight into run (script injection), actions pinned to a tag or branch, and jobs without permissions, each with a line number. It does not fully validate the schema or run the workflow.

- URL: https://tools.itlibra.com/en/github-actions-studio
- On-device・No upload
- Last updated: 2026-10-26

## How to use

1. Paste a workflow YAML (a .yml under .github/workflows), or drop the file. “Try a sample” shows how it works.
2. In the jobs and steps list, check on, the needs order, runs-on and the matrix combination count.
3. In the steps list, check the uses (action) and the first line of run for each step.
4. Open “Issues” for the list by severity. Injection with pull\_request\_target is high, unpinned third-party actions are medium, and the rest are low.
5. Copy or save the issue list.

## Use cases

- Check before merging that a PR title or comment is not written straight into run
- Decide whether a third-party action should be pinned to a full SHA instead of a tag
- See the default permissions of a workflow that omits permissions, before rewriting it
- Check the needs order and the matrix combination count without tracing them by hand

## What it does

### Script injection detection

Flags, with line numbers, places in run and in the script of github-script where a value anyone can write (such as github.event.issue.title) is expanded directly in an expression.

### Unpinned action findings

Lists actions whose uses version is a tag or branch. Third-party actions are medium; official actions and github are low (for attention). Actions pinned to a full commit SHA are not flagged.

### pull\_request\_target and checkout

With the pull\_request\_target trigger, flags a checkout of the PR head with actions/checkout as high.

### needs dependencies and matrix counts

Orders the jobs by needs, and flags needs that point to missing jobs and cycles. The matrix count is the product of its arrays.

### Permission and timeout checks

Flags jobs without permissions, write-all, and jobs without timeout-minutes.


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| Reading on (triggers), jobs and steps | Supported | — |
| needs order, cycles and missing jobs | Supported | — |
| uses versions (tag, branch, SHA) and docker:// digests | Supported | — |
| Script injection, printing secrets, pull\_request\_target with checkout | Partial | Checks only known context names and common forms. Other injection forms are not found |
| permissions, timeout-minutes and expression parentheses | Supported | — |
| Full schema validation (every key name and type) | Not supported | Not performed. Only unknown top-level keys are flagged |
| Running the workflow, fetching actions, network requests | Not supported | No network requests. The code of uses actions is not read |
| Expanding reusable workflows | Not supported | The called workflow is not read |

## Limits & notes

- Input is limited to 200,000 characters and 100 jobs. Anything beyond is not read, and you are told.
- Full schema validation is not performed. A misspelled key or wrong type may not be flagged, but GitHub may still reject the workflow.
- matrix counts only the product of its arrays. include and exclude are not counted, and an expression matrix cannot be counted.
- Findings follow GitHub’s official documentation only. Recommendations may change over time.

## Privacy & safety

Pasted YAML is processed only inside your browser. Nothing is sent to or stored on a server, and nothing is saved in the browser. Usage analytics never include content or file names.

## FAQ

### What is dangerous about pull\_request\_target?

Even for a PR from a fork, pull\_request\_target runs in the context of the base branch and can access the repository secrets. If you check out the PR head and run it there, untrusted code runs where the secrets are available. This tool flags that combination as high.

### Should uses be pinned to a SHA?

A third-party action can be pointed at different code later by changing its tag or main. Pinning to a full commit SHA keeps the code you reviewed. GitHub’s official documentation also recommends pinning to a SHA.

### What should permissions contain?

Only the permissions the job needs, starting from read (for example contents: read). If you omit it, the default token permissions apply, and those defaults can differ by repository setting.

### How is this different from a YAML checker?

General YAML syntax can be checked with the YAML and TOML studio. This tool focuses on GitHub Actions items (triggers, needs, uses and expressions) and on security findings.

### Can this tool run the workflow?

No. It does not run the workflow or fetch actions. Use a local runner, or check it on GitHub.