GitHub actions workflow visualizer

Paste a workflow and press Visualise.

This is a structural read, not a GitHub run. Matrix values and runs-on that contain ${{ }} expressions are kept and counted as written, not solved. Reusable-workflow calls appear as single graph nodes; their inner jobs are not expanded. Concurrency limits, environments, and secrets are not analyzed, and no action's metadata is fetched, so pinning advice is about the ref, not the action's contents. The injection check looks for untrusted expressions written straight into run: scripts; the safe pattern is to pass the value through the step's env: block and quote it in the script.