Your files stay on your device

# GitHub actions workflow visualizer

Paste a workflow YAML or drop the file to get triggers, a job dependency graph, matrix expansion and runner counts, plus findings for unpinned actions, broad permissions and expression injection.

Paste a workflow and press Visualise.

This is a structural read, not a GitHub run. Matrix values and `runs-on` that contain `${{ }}` expressions are kept and counted as written, not solved. Reusable-workflow calls appear as single graph nodes; their inner jobs are not expanded. Concurrency limits, environments, and secrets are not analyzed, and no action's metadata is fetched, so pinning advice is about the ref, not the action's contents. The injection check looks for untrusted expressions written straight into `run:` scripts; the safe pattern is to pass the value through the step's `env:` block and quote it in the script.
OptionsVisualise

## More config file tools

- [Compose file visualizer](/config/docker-compose-visualizer)
- [YAML](/config/yaml)
[All config file tools](/config)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/config/github-actions-workflow-visualizer
Markdown version: https://nutter.tools/config/github-actions-workflow-visualizer.md
Plain-text version: https://nutter.tools/config/github-actions-workflow-visualizer.txt
Agent index: https://nutter.tools/llms.txt