Feature request: add option to enforce security best practices

[stefreak]

It would be nice to add an option to check for security best practices.

Best practices that could be supported:

• set minimum GITHUB_TOKEN permissions
• Pin Actions to a full length commit SHA

Some other tools can already check for these things, like OSSF scorecard and StepSecurity SecureWorkflow.

Actionlint has an advantage over these tools though: It really understands advanced features like custom actions, reusable workflows etc. The tools I named are also hard to set up for private repositories, and actionlint is really easy to set up for private repositories.

[ansraliant]

Actually I was just thinking the same haha. I am currently trying to implement something.

I wanted to start (at least for now) on checking that we have the permissions set to none (or {} in gh actions jargon) at the beginning of the job.

[wolfeidau]

@stefreak I build a small program using actionlint as a library to solve the Pin Actions to a full length commit SHA problem, turns out there is a lot of "new" features needed to interact with the GitHub API. https://github.com/wolfeidau/github-action-workflow-check

Rate limits are so low you need to authenticate, which in turn requires other security features.