Nothing to hand? Load the — a pull_request_target fork checkout, actions on mutable refs, a PR title interpolated into a run script, a secret echoed into the log and no permissions block — or the , where the correct verdict is production-ready and the useful output is what to add next.
Paste the workflow — the prescan is free
No upload, no AI: the prescan reads every file in your browser and lists what it mechanically found. The workflow and job inventory, then the flags — actions on mutable refs, end-of-life action versions, missing or over-broad permissions, event text interpolated into run scripts, pull_request_target with a fork checkout, secrets echoed into logs, jobs without timeout-minutes, missing concurrency groups, deprecated workflow commands, continue-on-error on whole jobs, setup actions without dependency caching and self-hosted runners. Each group explains why it matters. This part costs nothing and happens while you type.
The AI reviews it — this is the metered part
A senior CI/CD engineer's pass: a production-readiness posture with the single most important change named, the inventory with each workflow's and job's role, and prioritized findings across correctness, security, robustness, cost, performance, maintainability and hygiene — each with the problem, the concrete impact, the fix and a corrected YAML fragment. Every prescan flag is confirmed or explicitly set aside. Findings may only cite jobs, steps, actions and expressions that actually appear in your paste. Pricing is honest: a worst-case amount is reserved before the run and only what the run actually uses is charged — the meter next to the button shows both.
Fix, export, re-run
Every corrected YAML fragment has its own Copy YAML button, so the fix goes straight into your editor without the prose around it. Copy as PR review comments renders the whole review as Markdown review comments — anchored to a real file and line wherever a prescan flag corroborates the finding, with the corrected YAML in a suggestion block — ready to paste into the pull request that changed the workflow. Quick wins cover the one-line changes, focus areas tie the real work to specific findings, and the findings table exports as CSV, Markdown or JSON. Review history is saved to your SkillSafe account (not just this browser), so when you come back with the fixes applied the app shows you what changed: which flags you fixed, which are still open and which are new — free, before you spend another run.
Derived from the @sickn33/github-workflow-automation skill.
Is Actions Clinic free?
The prescan is free and unlimited: paste or drop a workflow and the 13 mechanical checks run in your browser with no upload, no sign-in and no charge. The two bundled examples also replay their saved reviews for free. Only the AI review is metered — you sign in, a worst-case amount is reserved before the run, and you are charged only what the run actually uses, which is normally far less than the reservation.
What does the free prescan check for?
Thirteen families, all deterministic: actions on mutable refs (@main, @master or no ref at all), end-of-life action majors, a missing permissions block, permissions: write-all, attacker-controlled event text interpolated into a run: script, pull_request_target combined with a checkout of the PR head, secrets echoed into the log, jobs with no timeout-minutes, a missing concurrency group, deprecated ::set-output and ::save-state commands, continue-on-error on a whole job, setup-node / setup-python / setup-java steps with no dependency cache, and self-hosted runners.
Does my workflow YAML get uploaded?
Not until you press Review the workflow. Files you drop or pick are read in the browser with FileReader and never leave the page before a run. The prescan, the exports and the revision comparison all run client-side.
How is this different from actionlint or zizmor?
Those tools are mechanical detectors and they are good ones — this app's free prescan overlaps with them deliberately. What they cannot produce is the judgement layer: a production-readiness posture with the single most important change named, an inventory that says what each workflow and job is actually for, findings ranked by severity against likelihood with the concrete impact spelled out, and a corrected YAML fragment per finding. The review must also confirm or explicitly set aside every flag the prescan raised, so the two lanes are reconciled rather than duplicated.
Can I review several workflow files at once?
Yes. Drop the whole .github/workflows/ folder on the box, or pick a folder, and each file is inserted under a '# === file: path ===' header. Composite actions (action.yml) are handled the same way. The inventory then lists every file and every job separately.
What do I do with the review afterwards?
Each finding's corrected YAML has its own Copy YAML button so the fix goes straight into your editor. Copy as PR review comments renders the whole review as Markdown review comments — anchored to a real file and line wherever a prescan flag corroborates the finding, with the fix in a suggestion block — to paste into the pull request that changed the workflow. The findings also export as CSV, Markdown and JSON.
What happens when I fix the findings and come back?
Reviews are saved to your SkillSafe account, so they follow you to another machine rather than living in one browser. When you paste the revised workflow the app compares it against your last review for free and tells you which flags you fixed, which are still open and which are new — before you decide whether another paid review is worth it.
Which model does it run on?
gpt-terra, the balanced OpenAI tier alias, which currently resolves to gpt-5.6-terra. The app is also drivable programmatically — the API page documents every input field and the full output schema across cURL, Python, JavaScript, Go, Java, Ruby, PHP and C#.