Playground / GitHub Actions linter

GitHub Actions linter

Paste a workflow YAML and check it for actions pinned to a moving branch instead of a release, missing permissions:, secrets or untrusted PR/issue text interpolated straight into a shell step, and the pull_request_target pattern that hands a PR author your secrets. Nothing is uploaded; it’s checked entirely in your browser.