Know exactly what flows between your workflows.
GitHub Actions turns a missing matrix value, an undeclared secret or an optional input without a default into an empty value and keeps the run green. flowpact finds them across reusable workflows, local actions and every combination of the matrices written in your workflows.
npx flowpact lintIn CI, use the GitHub Action. In VSCodium, Cursor or Windsurf, install the extension from Open VSX.
Data flow, not just syntax
Follows every input, secret, env var and output across nested reusable workflows and composite actions.
Matrix-aware
Expands include/exclude exactly like GitHub and evaluates each binding per combination — catching the leg that silently gets an empty value.
Explains itself
Every finding has a code, the exact location, the call chain, why it matters, how to fix it and a docs link.
Trace anything
`flowpact trace pipeline.yml:config` shows where a value goes — or, with --up, where it comes from.
For publishers of reusable workflows and actions
Other repositories pin what you publish to a tag such as @v1, and a renamed job or a removed output breaks them without any error in your repository. Contracts put every change to inputs, secrets and outputs into the pull request as a YAML diff and mark the breaking ones. Impact mode grades each pull request as major, minor, patch or none, and fails it when a change needs a minor or major release and its title declares less, such as fix: on a renamed job. Turn both on in the GitHub Action with mode: check and impact: auto.
And in your editor, as you type
The VS Code extension reports the same findings before you push, and traces any input or output across files.
Open VSX serves VSCodium, Cursor, Windsurf and other editors built on VS Code. Other editors use flowpact lsp.