Editors

flowpact ships a language server, so the analysis runs while you edit instead of only in CI. In VS Code, install flowpact from the Visual Studio Marketplace; in VSCodium, Cursor, Windsurf and other editors built on VS Code, from Open VSX. The extension bundles the server. Other editors start it with flowpact lsp. You get:

• Diagnostics as you type — the findings of flowpact lint for the whole repository, closed files included, updated on every edit (unsaved ones too). Editing a reusable workflow updates its callers' findings at once. When .github/flowpact/contracts/ exists, flowpact check's contract findings (FP801–FP805) are included.
• Hover — how an input, secret, output, env variable or matrix key is declared, where its value comes from and where it flows, through every level of nesting.
• Go to definition across workflow calls and local actions: from with: config: to the callee's input, from needs.build.outputs.url to the reusable workflow's output, from steps.x.outputs.y to the action's output.
• Find references and highlights across files.

The server treats every directory with a .github folder as a repository, so monorepos and nested repositories work without configuration: the workspace folders are analyzed when the editor starts, and a repository nested inside one once you open one of its files. Your config (severities, overrides, ignores) applies as in the CLI.

HoverCopy Anchor Link

Hovering an input, secret, output, env variable, matrix key, job or uses: value shows a short card from flowpact:

• Header: flowpact, the kind of symbol, and a link to this section.
• First line: the symbol and where it belongs, with its declaration: type, required or optional, default, values.
• From / To: where the value comes from (callers' values, upstream outputs) and where it goes (a callee's inputs, scripts, conditions), one hop each, with any further entries counted. flowpact trace shows the whole chain.
• On a caller's with: or secrets: key, the card shows what this call passes and where the value goes in the callee.

Other extensions add their own sections below it; GitHub's GitHub Actions extension, for example, describes the key's syntax.

VS CodeCopy Anchor Link

Install flowpact from the Visual Studio Marketplace, or from Open VSX in VSCodium, Cursor, Windsurf and other editors built on VS Code:

code --install-extension flowpact.vscode-flowpact

It bundles the language server, so nothing else needs to be installed, and works in VS Code 1.101 and later. The server starts when the workspace has workflows or an action.yml, at a folder's root or nested deeper, or when you open one; other workspaces only load the extension.

It complements GitHub's GitHub Actions extension, which completes and validates workflow syntax file by file: flowpact adds what crosses files (the data flow through reusable workflows and local actions, go to definition and references across them), and by default hides the four rules both would report (flowpact.overlappingRules).

SettingsCopy Anchor Link

Logs: the flowpact output channel (flowpact: Show Output). Its log level (Developer: Set Log Level…) is also the server's: set it to Debug to see every stage of the analysis, or to Trace for the protocol messages too. VS Code's own extension host log can say Not activating extension 'flowpact.vscode-flowpact': Timed out while searching… in a large workspace even though flowpact runs: it then starts after VS Code's startup instead. The output channel and the language status item show its real state.

Commands: flowpact: Restart Language Server — also needed after you edit a plugin, since a loaded plugin stays loaded — and flowpact: Show Output.

Workspace trustCopy Anchor Link

In an untrusted workspace (Restricted Mode), everything works except plugins, which run code from the repository. Trusting the workspace loads them without a restart; the language status item next to the file type says when they are off. Plugins load only for repositories inside the workspace folders: not for a file opened from elsewhere, nor for a repository above the folder you opened.

LimitationsCopy Anchor Link

• A repository needs a .github folder to be analyzed in the editor; one with only an action.yml gets no diagnostics there yet (flowpact lint checks it).
• env set on a step or in a composite action, steps.<id>.outcome / conclusion and step ids are not navigable yet.
• Contract files (.github/flowpact/contracts/) show their findings but have no hover or go to definition.
• There are no quick fixes, rename or completion yet.

Other editorsCopy Anchor Link

flowpact lsp starts the same server over stdin/stdout, for any editor with an LSP client. It needs flowpact installed. Settings are read from the client's initializationOptions, and from workspace/didChangeConfiguration under flowpact:

NeovimCopy Anchor Link

With Neovim 0.11 or later:

vim.lsp.config('flowpact', {
  cmd = { 'flowpact', 'lsp' },
  filetypes = { 'yaml' },
  root_markers = { '.github' },
})
vim.lsp.enable('flowpact')

To use the plugins the config lists, add init_options = { plugins = true }.