GitHub Actions · Checked November 3, 2026

GitHub Actions: "Unexpected input(s) ..., valid inputs are [...]"

This is a warning, not an error: the step runs anyway. Before running an action, the runner compares the names under with: with the inputs listed in that action's action.yml at the version you use. A name that is not in the list does not stop the step, but the action has no such setting, so it has no effect. The job can pass while doing something other than what the workflow says.

What it looks like

From a deploy job reported on October 1, 2026 (openfoodfacts-server #14791), shortened:

Unexpected input(s) 'continue-on-error', valid inputs are ['host', 'port', 'passphrase', 'username', 'password', ...]

• The list after "valid inputs are" is every input the action declares at that version.
• The runner compares names without regard to case, so Python-Version and python-version match, but repo-token and repo_token do not.
• It checks actions in a repository, including local ones (uses: ./.github/actions/x). Actions run straight from a Docker image (uses: docker://...) have no action.yml and are not checked.

What it cost in October

• python-version on astral-sh/setup-uv@v3: v3 has no such input (it arrived in v4.1.0), so every leg of a Python matrix ran on the runner's own Python and tested the same version (iota-hub-python #2).
• trivy-version on aquasecurity/trivy-action: the input is called version, so a pin to a newer Trivy was never applied, and the scans used the action's default (pa-sso-proxy #71).
• archive: false on actions/upload-artifact before v7: the input exists only from v7.0.0 (February 26, 2026), so the artifact was still zipped (gas_atlas #398).
• file: on codecov/codecov-action v5 or later, which take files: the explicit coverage path was dropped, and the upload fell back to the action's own search for coverage files (aip-otel-exporter #170).
• repo-token, issue-message and pr-message on actions/first-interaction v2 or later, which renamed them to repo_token, issue_message and pr_message. Here the job also failed, with "Input required and not supplied: issue_message" (ellmos-voice-io #1).

The usual causes

• The input belongs to another major version of the action: added in a later one, or renamed or removed in the one you now use. This is the common case after a version bump.
• A step key is written under with:. continue-on-error, timeout-minutes, if and env belong to the step itself, at the same level as uses:, as in the example above.
• A typo, or a hyphen where the action uses an underscore.
• A local composite action that does not declare the input under inputs: in its own action.yml (agentic-development-workflow #792). Declare it there, or stop passing it.

Reading the inputs of the version you use

The warning already lists them. To see them before a run, read action.yml at the same tag (some actions name it action.yaml):

gh api "repos/astral-sh/setup-uv/contents/action.yml?ref=v3" --jq .content \
  | base64 -d | sed -n '/^inputs:/,/^[a-z]/p' | grep -E '^  [A-Za-z0-9_-]+:'

Then rename the input, or move to a version that has it. After the change, check the result in the log, such as the Python version that was set up or the Trivy version that ran: the warning going away shows only that the name now matches.

Catching it before it runs

actionlint checks with: against the action.yml of local actions and against its own list of popular actions, and reports a line like input "keys" is not defined in action "actions/cache@v4". Its list in v1.7.12 includes actions/first-interaction, actions/upload-artifact and codecov/codecov-action, but not astral-sh/setup-uv or aquasecurity/trivy-action, so for those the warning in the run is the check.

Telling it apart

• "Input required and not supplied: ...": an error, and the step fails. The action needs an input you did not give, often because it was renamed.
• "Input '...' has been deprecated with message: ...": the input still exists and still works, but the action plans to remove it. The message usually says what to use instead.
• "Invalid workflow file" with "Unexpected value": a key in the wrong place in the workflow itself, which stops the whole file before any job starts ("Invalid workflow file").

See your runs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

GitHub and GitHub Actions are trademarks of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc. or JetBrains.

More: "Invalid workflow file" · The "Node.js 20 is deprecated" warning · setup-python's "was not found" · "Input required and not supplied" · "Unable to reserve cache" · GitHub Actions plugins for IntelliJ IDEA compared · 日本語