github-actions-validation

Validate GitHub Actions workflows with actionlint, ghalint, and zizmor.

1|Updated Dec 8, 2025
One-click install
npx skills add https://github.com/y-miyazaki/arc --skill github-actions-validation
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: github-actions-validation
Source: https://github.com/y-miyazaki/arc/tree/main/.github/skills/github-actions-validation
Command: npx skills add https://github.com/y-miyazaki/arc --skill github-actions-validation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires actionlint, ghalint, zizmor, and includes scripts (resource) components.

What problem does it solve?

This skill provides guidance and tooling to validate GitHub Actions workflows, catching syntax errors, security misconfigurations, and best-practices issues before they run in CI.

Core Features & Use Cases

  • Comprehensive validation: validates workflow syntax, security posture, and configuration using actionlint, ghalint, and zizmor.
  • Troubleshooting guidance: includes a centralized validation script and debugging steps to diagnose failures quickly.
  • Use Case: before merging a PR containing workflow changes, run the validation to ensure workflows pass checks and adhere to best practices.

Quick Start

Run the centralized validation script to assess all workflows: bash github-actions-validation/scripts/validate.sh You can also target a specific directory: bash github-actions-validation/scripts/validate.sh ./.github/workflows/

Frequently Asked Questions about github-actions-validation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate GitHub Actions workflows for syntax errors and security misconfigurations?

To validate GitHub Actions workflows, you can run a centralized validation script that uses actionlint, ghalint, and zizmor to check syntax, security posture, permissions, and workflow triggers before merging PRs.

What is the best way to check GitHub Actions CI pipelines for security and best practices?

Checking GitHub Actions CI pipelines involves applying comprehensive validation tools like actionlint, ghalint, and zizmor to enforce quality and security standards across all workflow configurations.

Does this GitHub Actions validation support targeting a specific workflows directory?

Yes, GitHub Actions validation supports targeting specific directories by passing the path as an argument to the validation script, such as ./.github/workflows/, for localized checks.

Why does my GitHub Actions workflow validation fail and how do I troubleshoot it?

GitHub Actions workflow validation failures can be diagnosed using the included debugging steps and centralized validation script, which provide guidance to quickly identify syntax errors, security misconfigurations, or trigger issues.

Can I use actionlint and zizmor together to check workflow permissions and triggers?

Yes, the validation script integrates actionlint, ghalint, and zizmor to comprehensively check GitHub Actions workflow permissions, security configurations, and triggers in a single pass.