seiton playground

Security-focused linter & fixer for GitHub Actions

Loading WebAssembly binary...

About the playground

The seiton playground is a static page: after the WASM runtime loads, it parses and lints GitHub Actions workflow and action metadata YAML in your browser. Your YAML is not uploaded to a server for analysis.

You can edit YAML in the editor, load built-in samples, open a document from a URL you enter (your browser requests that URL directly), or use Share to store workflow YAML and lint config in the page URL when it fits. If the URL would be too long, Share falls back to workflow YAML only or copies both to your clipboard. Very large snippets may exceed browser URL length limits when sharing.

There are practical limits to what the playground can do:

It performs static checks only—it does not run workflows, actions, or run: steps on GitHub’s infrastructure.
Fetch by URL only contacts the host you specify; the playground does not proxy your YAML through another backend.
Apply all fixes runs locally for most fixes. When enable-network: true is set in config, SHA/digest pinning resolves via the GitHub API (unauthenticated, 60 requests/hour limit).
Behavior matches the bundled Seiton build. A version badge appears in the header, which reflects this deployment.

The source code is available on GitHub.

About the playground

References