actionlint

actionlint, published under the rhysd repository, is a static checker for GitHub Actions workflow files. Instead of waiting for a workflow to fail in CI, you run it locally or in a pipeline and it reports mistakes in the YAML, so broken workflows are caught before they are pushed or merged.

It validates workflow syntax against the documented keys, type-checks the ${{ }} expressions to catch references to missing properties and mismatched types, and verifies that inputs and outputs of actions and reusable workflows are used correctly. It can also run shellcheck and pyflakes on inline scripts, and includes security checks for script injection from untrusted inputs and hard-coded credentials. Other checks cover glob patterns, job dependencies, runner labels and cron syntax.

The tool is a single command written in Go and released under the MIT licence. You can install a released binary, use Homebrew or go install, or run it through Docker, and an online playground runs it in the browser through WebAssembly. It aims to keep false positives low, which suits developers and DevOps engineers who maintain many workflows.