Lesstep
GitHub Actions · Checked November 3, 2026

GitHub Actions: "Invalid workflow file"

GitHub could not read the workflow file, so it did not start any job from it. One mistake anywhere rejects the whole file: every job in it stops, including the ones that have nothing to do with the line in the message. Other workflow files in the repository are not affected.

What it looks like

The messages, and what to change

Unrecognized named-value: 'secrets'

From a release workflow in September (TimoDesk #44):

Invalid workflow file
(Line: 52, Col: 13): Unrecognized named-value: 'secrets'.
Located at position 1 within expression: secrets.KEYSTORE_BASE64 != ''

GitHub's documentation says secrets "cannot be directly referenced in if: conditionals." Put the test in the job's env, where secrets is available, and test the variable:

jobs:
  release:
    runs-on: ubuntu-latest
    env:
      HAS_KEYSTORE: ${{ secrets.KEYSTORE_BASE64 != '' }}
    steps:
      - name: Sign
        if: env.HAS_KEYSTORE == 'true'
        run: ./sign.sh

Unrecognized named-value or function in another key

Each key can use only some contexts and functions, listed in the "Context availability" table of GitHub's contexts reference. Two that come up often:

Unexpected symbol

Unexpected symbol: '3dsx' in steps.plan.outputs.3dsx == 'true': a name after a dot cannot start with a digit. The fix in that case was to rename the output to want_3dsx (3ds-GBabe #2).

Unexpected value '...'

A key is in a place that does not take it, often because of its indentation. Unexpected value 'schedule' came from schedule: written inside a job, when it belongs under on: (ChiaEngine #96).

A job that calls a reusable workflow (uses: ./.github/workflows/x.yml) can have only a short list of keys: name, uses, with, secrets, strategy, needs, if, concurrency, permissions and cache-mode. runs-on, env, steps and timeout-minutes go in the called workflow's own jobs. One project's release workflow stopped creating jobs when timeout-minutes was added to such a job (openchamber #118).

'with' is already defined

The same key appears twice in one block, for example a second with: or env: in the same step (hisabkikitab #16). Merge the two into one.

You have an error in your yaml syntax on line N

The file is not valid YAML at all. A common cause is text inside run: | that starts at column 0, such as the body of a heredoc: it ends the block early, and YAML reads the next line as a new key (cornucopia #3688). Indent those lines like the rest of the block. YAML removes that indentation before the shell sees the script, so the heredoc still works.

The nested job is requesting ..., but is only allowed ...

The workflow is not valid. .github/workflows/nightly.yml (Line: 63, Col: 3): Error calling workflow '...'. The nested job 'matrix' is requesting 'id-token: write', but is only allowed 'id-token: none'.

A called workflow can lower the GITHUB_TOKEN permissions it gets from the caller, never raise them, and a scope left out of a permissions block is none. Add the scope to the calling job's permissions. One release broke when contents: write was removed from such a job without adding back contents: read (xlq #145). These runs end as "Startup failure" rather than failing with no jobs, and a scheduled one keeps starting and failing every night (langwatch #9187).

Catching it before you push

actionlint (v1.7.12) checks workflow files on your machine or in CI. It reports most of the mistakes above, for example context "secrets" is not allowed here and unexpected key "schedule" for "job" section, but it does not know what a called workflow needs, so the permissions error is found only by GitHub. Run it from a workflow file of its own: a lint job in the broken file never starts.

name: Lint workflows
on: [push, pull_request]
jobs:
  actionlint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Check workflow files
        run: |
          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
          ./actionlint -color
        shell: bash

Telling it apart

See failed runs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, and your current branch's runs are in the status bar, so a run that failed with no jobs shows up where you are already working. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

GitHub and GitHub Actions are trademarks of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc. or JetBrains.

More: "Unable to resolve action" · "Resource not accessible by integration" · No workflow_dispatch trigger · The "Unexpected input(s)" warning · GitHub Actions plugins for IntelliJ IDEA compared · 日本語