1. Paste one or more workflow files
Copy the contents of each file under .github/workflows/ you want checked. Add more blocks for more files — nothing here reads your repository, so pasting is how it sees anything.
Paste at least one workflow file above and click Check.
Findings
| File : Line | Type | Detail | Fix |
|---|
Prefer a CLI, or want this in your own CI?
Same logic, zero dependencies, one file:
python3 check.py # scan .github/workflows under the current directory
python3 check.py /path/to/repo # scan a specific checkout
python3 check.py --format json # machine-readable
python3 check.py --fail-on-risk # exit 2 if any finding exists
Get check.py from the repo — stdlib only, nothing to install, no network calls. Wire --fail-on-risk into your own CI to block a job added without a timeout before it merges.
Common questions
What happens to a GitHub Actions job with no timeout-minutes?
A job on a GitHub-hosted runner that never sets timeout-minutes is cancelled only when it reaches GitHub's default limit of 360 minutes (six hours). A deadlocked test, a stalled download or a step waiting on input then holds the runner — and, on a private repository, bills minutes — for the whole six hours.
Why does the runner type change the number?
On private repositories GitHub's documented minute multipliers are higher for Windows and macOS runners than for Linux, so the same hung six hours consumes more of your included minutes. Check GitHub's current billing page for the live multipliers; this tool uses them only to print an upper bound.
Is timeout-minutes: 360 a real limit?
No. 360 is the default restated, so it limits nothing. This tool flags it separately because it looks like a guard when it is not.
Does this tool fetch anything from GitHub for me?
No. It makes no network calls at all — nothing here can, because nothing here talks to a server. Paste your workflow YAML and the scan runs entirely in this page.
Does a clean scan mean my workflows are safe?
No. This checks one specific pattern in a single workflow file at a time. It is not a security audit or a cost audit, and it does not choose a correct timeout for you — too short a timeout cancels healthy runs. It does not look at step-level timeouts or at the called workflow behind a reusable-workflow call.
More: what is timeout-minutes and what should you set it to?