# Check GitHub Actions before merging workflows

> Check syntax, security and action pins before running a workflow with access to your repository.

Source: https://fullbytedeveloper.com/blog/github-actions-five-workflow-checks
Keyword: ACTIONGATE
Published: 2026-11-05

GitHub Actions workflows need checks before they receive repository access. The actionlint, zizmor, pinact, ratchet and act projects cover different parts of that review. [1][2][3][4][5]

## Check syntax and security

Install actionlint and zizmor using their linked installation instructions. From your repository, actionlint checks workflow syntax and expressions; zizmor scans for security problems. [1][2]

```bash
actionlint
zizmor .
```

Read the reported file locations and fix each finding before running the workflow.

## Pin action versions

Per the pinact README, this command edits workflow and composite-action files to pin action references. Review its changes before committing them. [3]

```bash
pinact run
```

Use ratchet to check those pins afterward. Its lint command exits unsuccessfully when it finds an unpinned reference. [4]

```bash
ratchet lint .github/workflows/*.yml
```

## List the jobs before a local run

The act documentation provides a list mode for a specific event. [5]

```bash
act -l pull_request
```

You should see the jobs for that event. A full run requires a working container setup and the event inputs your workflow uses. Review the workflow before allowing it to run locally, where it can execute its commands. [5]

Keep these checks in the pull-request review so a passing local run is one piece of evidence about the change.

## Sources

1. [actionlint repository](https://github.com/rhysd/actionlint)
2. [zizmor quickstart](https://docs.zizmor.sh/quickstart/)
3. [pinact repository](https://github.com/suzuki-shunsuke/pinact)
4. [ratchet repository](https://github.com/sethvargo/ratchet)
5. [act usage guide](https://nektosact.com/usage/index.html)

## Original posts

- [Facebook reel](https://www.facebook.com/reel/1850123709459166)
- [Threads post](https://www.threads.com/@fullbytedeveloper/post/DfRWVruJx6Q)
- [TikTok video](https://www.tiktok.com/@fullbytedeveloper/video/7703844199468256513)