Online Tool Store
GitHub Actions Workflow Builder
Assemble a GitHub Actions workflow — triggers, matrix, caching, and permissions — and get valid YAML with the common pitfalls avoided.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
Developer
GitHub Actions Workflow Builder
Frontend preview — no upload or external service.
workflow.yml
A push-and-PR workflow on ubuntu-latest with a Node matrix of 20 and 22, dependency caching keyed on the lockfile, and permissions narrowed to contents: read.
How the GitHub Actions Workflow Builder works
- Choose when the workflow should run — most repositories want push plus pull_request, and nothing else.
- Pick the runtime and whether you need a version matrix or dependency caching.
- Copy the YAML into .github/workflows/ and commit it on a branch so the first run is a pull request, not main.
FAQ
Why set permissions explicitly?
Because the default token can be broader than a build needs. Declaring permissions: contents: read at the top and widening only for jobs that publish is the single highest-value hardening step in a workflow.
What should the cache key be?
A hash of the lockfile, not the branch name. Keying on the lockfile means the cache is reused whenever dependencies are unchanged and invalidated the moment they are not.
Should actions be pinned to a SHA?
For anything touching secrets or publishing, yes — a tag can be moved, a commit SHA cannot. Version tags are acceptable for routine build steps.
How we compare
| Feature | Online Tool Store | A CLI script | An IDE plugin |
|---|---|---|---|
| Narrow default permissions | ✓ | ✗ | Sometimes |
| Lockfile-based cache key | ✓ | If you know it | ✓ |
| No repository access needed | ✓ | ✓ | ✗ |
| Explains each choice | ✓ | ✗ | ✗ |
The workflow this produces is a starting point that already gets permissions and cache keys right — the two things hand-written CI files usually get wrong.