Kubernetes Manifest Validator
DevOps & cloud Local only
GitHub Actions Workflow Validator
Local workflow reviewVisualize workflow DAGs and matrices, review actions and expressions, find risks, and compare CI changes.
Paste a .github/workflows YAML file…
Static analysis runs locally and does not execute runners, resolve secrets, or contact GitHub.
Ready to inspect a workflow
Paste or open GitHub Actions YAML to visualize jobs and matrices, review dependencies and identify security risks.
How to use it
- 01
Open a workflow
Paste or open a GitHub Actions YAML file to inventory triggers, permissions, jobs, steps, runners and environments.
- 02
Explore execution shape
Follow job dependencies, expand static matrices, inspect reusable workflows, actions and expression contexts.
- 03
Review and compare
Investigate security and semantic diagnostics, compare another workflow, export a review, and reproduce deeper checks with official CLI tools.
Frequently asked questions
Does this run my workflow?
No. A static page cannot emulate GitHub-hosted or self-hosted runners. It analyzes declarative evidence and gives commands for actionlint and GitHub CLI verification.
Why are mutable action tags flagged?
Third-party tags and branches can move. Pinning a full commit SHA reduces dependency substitution risk, while update automation can keep the SHA current.
Can every matrix be expanded?
Static arrays, include and exclude entries are expanded with a safety cap. Matrices produced by expressions or prior job outputs remain dynamic until GitHub evaluates them.
Are secrets evaluated?
No. The analyzer identifies secret context usage but never resolves repository settings, environments, organization policy, reusable workflow internals or actual secret values.
Related tools
Keep working with other focused browser utilities.