Summarize GitHub Actions workflows: triggers, jobs with runners and needs, permissions per job, every action used (version, whether pinned to a commit SHA), environments, and the NAMES of the secrets each job references (values are never read). Also covers local composite actions under .github/actions. path is a workflow file, a repo root containing .github/workflows, or the workflows directory. Invalid YAML is reported with its line instead of failing. Start here.

Lint workflows and composite actions with 33 rules (GHA1001-GHA1033). Each finding has a rule id, severity (error/warning/info), file:line (exact line inside multi-line run: | blocks), an explanation and a concrete fix. Covers: actions not pinned to a commit SHA, pwn requests (pull_request_target / workflow_run + checkout of PR code), script injection through github.event.* / head_ref / inputs inside run: or github-script, missing or write-all permissions, secrets: inherit, secrets echoed or on command lines, curl | bash, checkout credentials left behind, self-hosted runners on PR triggers, deprecated commands (set-output, set-env), timeouts, concurrency, needs mistakes and cycles, always-true if: expressions, unknown/misspelled contexts, matrix size, reusable-workflow input/secret mismatches, retired action versions (dated table), cache keys, continue-on-error, unquoted 3.10 versions, invalid cron. Suppress with # workflowlint-ignore: GHA1003 above the line. Never modifies anything.

Explain in plain English when each workflow runs: push/PR filters, which pull request types, fork behaviour, manual inputs, reusable-workflow interface, workflow_run chains, and schedule cron expressions explained with the next 5 run times in UTC (computed by a built-in cron implementation, including the day-of-month OR day-of-week rule). Flags congested schedules (minute 0), intervals under 5 minutes, and reminds that scheduled workflows run only on the default branch and are disabled after 60 days of repository inactivity.

Show the effective GITHUB_TOKEN permissions of every job (job-level replaces workflow-level; absent means the repository default), infer what each job actually needs from the actions and gh/git commands it uses, flag write access that looks unnecessary and permissions that are missing, and print a least-privilege permissions: block per job. The inference is heuristic and says when it is partial.

Draw each workflow's job needs: graph as text and as a Mermaid diagram, group jobs into waves that can run in parallel, and show the critical path (longest dependency chain) plus a worst-case duration bound from timeout-minutes. Reports cycles.

List every uses: that is not pinned to a full commit SHA (grouped by action version, with file:line) and how to pin each. With online=false (default) nothing touches the network and you get git ls-remote instructions. With online=true each tag or branch is resolved to its commit SHA through api.github.com only (annotated tags are dereferenced; results cached; honest rate-limit messages; an optional GITHUB_TOKEN in the server's environment raises the limit and is sent only to that host). Output is a plan as text: nothing is written.

Show a unified diff of the safe automatic fixes for a workflow file (or every workflow under a directory): add a top-level permissions: contents: read when every job is recognised as read-only, move injectable ${{ github.event.* }} expressions out of run: scripts into step env: variables, and replace ::set-output with $GITHUB_OUTPUT. The patched text is re-linted to prove the findings disappear and none are introduced. Never writes the file: apply the diff yourself. Lists what needs a manual change.