Skip to content

WorkflowGuard v1.0.0 — Actions security checks

Choose a tag to compare

View all tags
@GhosTnever-lkm GhosTnever-lkm released this 08 Oct 01:27
· 14 commits to main since this release
v1.0.0
c270587
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

WorkflowGuard v1.0.0

Offline security checks for GitHub Actions workflow YAML.

  • 8 focused checks for permissions, pull_request_target, action pinning, checkout credentials, secret interpolation, untrusted shell input, and reusable workflow refs.
  • Text, JSON, and SARIF reports.
  • Local scanning only: the tool does not execute workflow commands or send workflow contents over the network.
  • Python 3.11+; wheel and source bundle are attached to the repository files.

Verification: 41 tests passed on Windows; 2 symlink tests were skipped because symlink creation was unavailable in this environment. The repository self-scan reported 0 findings.

Static analysis is not a guarantee that a workflow is safe. Review each finding and inspect third-party Actions yourself.

Assets 4
Loading