Workflow auditing tools to identify security issues in GitHub workflows
usage: main.py [-h] [--type {repo,org,user}] input
Identify vulnerabilities in GitHub Actions workflow
positional arguments:
input User/Org Name or Repo name (owner/repo).
optional arguments:
-h, --help show this help message and exit
--type {repo,org,user}
Type of entity that is being scanned.
Example:
- org -
python3 main.py --type org google - user -
python3 main.py --type user test_user - repo:
python3 main.py --type repo TinderSec/gh-workflow-auditor
GitHub Workflow Auditor uses GitHub's GraphQL endoint. Due to this, an API token is required. You can generate a basic PAT token with no read access for this.
export PAT=ghp_YOUR_TOKEN
GitHub Workflow Auditor identifies vulnerability in GitHub Workflows. It does so by scanning the workflow files for anti-patterns such as ingesting user inputs in an unsafe manner or using malicious commits in build process. The tool supports scanning individual repositories or all accessibe repositories of a user or organization. The output of the scan is saved as scan.log.