Skip to content

v0.67.0 - Agentic workflow audit

Choose a tag to compare

View all tags
@grnbtqdbyx-create grnbtqdbyx-create released this 01 Jun 04:14
· 6 commits to main since this release
v0.67.0
4a91097
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ContextForge v0.67.0

This release adds contextforge workflow-audit, a deterministic GitHub Actions audit for agentic workflow injection risk.

Highlights

  • Detects untrusted issue, PR, review, comment, discussion, or workflow input text flowing into agentic commands/actions.
  • Flags agentic workflows that run with pull_request_target or write-capable permissions.
  • Flags repository secrets combined with untrusted event text in agentic jobs.
  • Emits contextforge-workflow-audit.md and contextforge-workflow.sarif.
  • Wires the reusable Action, generated workflow, dogfood workflow, artifact upload, and Code Scanning upload.
  • Adds docs/workflow-audit.md, AI-readable llms.txt updates, and a risky demo fixture.

Verification

  • PR #159 passed CI and ContextForge Audit on GitHub.
  • Main commit 4a91097 passed CI and ContextForge Audit.
  • Local validation included typecheck, full tests, build, security benchmark, audit, workflow-audit artifact generation, publish-readiness, and npm pack dry-run.
Assets 2
Loading