GitHub Actions Toolkit

Validate, visualize, lint, and audit secrets in GitHub Actions workflows — four tools covering correctness and security. All run entirely in your browser.

How these fit together

GitHub Actions Validator catches structural mistakes before you push — a missing trigger, a broken needs: reference, an unpinned action. Workflow Visualizer shows the actual job execution order a needs: graph produces, waves of parallel jobs included, so you don't have to trace it by hand. GitHub Actions Linter moves from "does it run" to "should it run this way" — script-injection risk, the pull_request_target pwn-request pattern, deprecated workflow commands — and Secrets Checker traces exactly where a workflow's secrets can leak, from an unpinned third-party action to a value echoed straight into the log.

GitHub Actions Validator

Check a GitHub Actions workflow for broken needs/outputs references, unpinned actions, and structural errors.

GitHub Actions Workflow Visualizer

See a GitHub Actions workflow's real job execution order, computed from its needs: graph.

GitHub Actions Linter

Catch script-injection risk, the pwn-request pattern, deprecated commands, and other GitHub Actions security gotchas.

GitHub Actions Secrets Checker

See where a workflow's secrets flow — unpinned third-party actions, log-echoed secrets, secrets: inherit, and pull_request_target exposure.