GitHub Actions Workflow Review

How to use GitHub Actions Workflow Review

Expand bounded literal job matrices and review supplied needs dependencies, action references and authored token-permission declarations without running a workflow. Trace include/exclude source witnesses and dependency cycles. Dynamic expressions remain unexpanded, shell bodies stay omitted, and repository defaults or runtime security decisions remain unassessed.

1. Provide optional workflow yaml file, one local github actions workflow yaml.
2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
3. Copy the result or download a separate output; reset to clear the current form.

Good to know

• One UTF-8 YAML core-schema object up to 200 KB, 5,000 physical lines, 8,192 characters per line, 80 leading spaces, 20 parsed structural levels and 10,000 nodes. BOM, bare CR, prohibited controls, aliases, explicit tags, non-string/prototype-related map keys and unsafe/nonfinite numbers are refused. A conservative raw brace/bracket punctuation-depth cap of 40 also applies inside supplied script strings/blocks; this is a safety limit, not a YAML grammar claim.
• Review 1–100 literal jobs, at most 25 unique literal needs per job, 200 steps per job and 2,000 overall. Missing needs and cycle witnesses remain explicit. The dependency-first order concerns authored source edges only; event triggers, conditions, skipped/failing jobs, runner queues and execution order are not simulated.
• Literal matrices support 1–8 scalar axes of 1–64 values, or include-only entries. Strings are at most 1,024 UTF-8 bytes; integral numbers must be safe. Object/array axis values are refused. Axis and include/exclude variable names are folded to lowercase, while the include/exclude keywords must use exact lowercase spelling. At most 16 distinct variable names, 128 include/exclude objects each, 256 unfiltered/expanded rows per job and 1,024 rows combined.
• Exclusions remove partial-matching original Cartesian rows before includes. Each include may update only remaining original rows without overwriting an original axis value; added include rows are not updated by later includes. Added properties on original rows may be overwritten by later includes. A conservative upper bound of 100,000 potential serialized matrix-value characters per job is checked before construction.
• Any supported matrix value or whole matrix containing ${{ remains unexpanded; the tool never evaluates an expression, command, action, context, output or secret. Source run bodies and environment values are not returned. Matrix values and uses strings are intentional report data, so remove sensitive authored matrix/uses text before sharing.
• Permissions show the selected authored job/workflow declaration, read-all/write-all or a bounded read/write/none map. Unspecified keys in an explicit map are labeled none, but the permission-name catalog, repository/org defaults, fork/Dependabot reductions, called-workflow restrictions and actual granted capabilities are unassessed. Parsing does not certify workflow schema validity or security.
• Action/reusable-workflow references are source strings only; nothing is fetched. Secret-reference name candidates are a lexical scan of supplied strings, not parsed expression dependencies or secret values. A same-origin module Worker loads the YAML-backed core before ready, with a 10-second preparation deadline and separate 2-second computation limit.
• Structured text output is limited to 500,000 characters. Reduce the supplied source when that separate output budget is exceeded.
• Inputs are processed on this device and are not automatically saved or uploaded.