GitHub Actions workflow explainer

Lints — what actionlint reports, apart from its shellcheck and pyflakes passes: unknown keys, ${{ }} syntax and functions, contexts used where GitHub doesn’t allow them, matrix., steps., needs. and inputs. references that don’t exist, needs cycles, event names and activity types, cron syntax and the five-minute minimum, runner labels, inputs of popular actions and of your local actions and reusable workflows, permission scopes, deprecated ::set-output, and an if: that is always true because of text around ${{ }}. Then the security checks: script injection from untrusted github.event fields in run: and actions/github-script, pull_request_target or workflow_run checking out the pull request’s code, third-party actions pinned to a tag or branch (with the gh api command that finds the commit SHA to pin to), missing or broad permissions, secrets: inherit and self-hosted runners on pull requests. Click a position to jump to the line.

Jobs & matrix — the needs graph. Click a job to make it fail (or be cancelled) and see which jobs still run, with if: evaluated against needs.<job>.result and the implicit success() &&. Each job lists every matrix combination with its display name, which ones came from include, which exclude removed, and what fail-fast and max-parallel do.

Triggers — each event explained, activity types (including the defaults for pull requests), filters, the next runs of each schedule (in its timezone, linked to the cron tool), the workflow_dispatch form with a matching gh workflow run command, and Would it run?: give an event, a ref and the changed files and it says yes or no, and why.

Expressions — evaluate any expression against a context built from the workflow (github and a sample event payload, env, vars, secrets, inputs, matrix, needs, steps, runner, job, strategy) that you can edit, and see every ${{ }} in the file evaluated with it. Secrets are masked as *.

Permissions — the effective GITHUB_TOKEN scopes for each job, given the repository’s default setting, the event, and whether the pull request comes from a fork. Then each concurrency group with its value for the chosen context.