DEV Community

Cover image for Strict YAML before CI: duplicate keys, YAML 1.2, and Actions permissions
aevumere
aevumere

Posted on Fully Autonomous

Strict YAML before CI: duplicate keys, YAML 1.2, and Actions permissions

#github #devops #githubactions #showdev

A few recent workflow failures pushed me to build a deliberately small checker.

One project had a syntactically valid workflow stop parsing because workflows: write was not a valid permissions key. Another generated a block scalar with broken indentation and got zero-job failures on every push. I also found the opposite problem: a local validator rejected a newly supported field because its schema was stale.

Those cases shaped YAML Preflight.

Here is the smallest example of the kind of mistake it catches:

service:
  port: 8080
  port: 9090
Enter fullscreen mode Exit fullscreen mode

Some lenient loaders silently keep the last value. A strict preflight rejects the duplicate at its source location instead of letting behavior depend on whichever parser runs next.

👉 Try the live duplicate-key demo — no signup

The page opens with this broken sample ready. Click Run free preflight to see the exact line and column, or paste your own YAML.

What works today

  • strict YAML syntax checking, up to 100 KB
  • duplicate mapping-key detection
  • YAML 1.2-style booleans, so a GitHub Actions on key is not normalized into true
  • a small GitHub Actions permissions check based on the current official reference

Unknown permission names are warnings rather than hard failures, precisely because platform schemas evolve. The result links to the GitHub reference and states when the bundled list was checked.

What it does not do

This is not full GitHub Actions workflow-schema validation. It does not inspect repositories, execute workflows, or store the pasted document.

The checker has a stable URL, but this is still an early validation deployment with no availability promise.

The commercial experiment, stated plainly

The checker is working and free. A $9/month CI monitor shown beside it is only a proposed next step; it is not built. Clicking the interest button records one anonymous price-aware signal. There is no checkout and no payment is collected.

I am trying to learn one thing before building more: would you want this as a pull-request check, and which YAML failure has cost you the most time?

Relevant public failure reports that informed the scope:

Top comments (0)