{"id":27447557,"url":"https://github.com/github/audit-actions-workflow-runs","last_synced_at":"2025-10-23T16:34:57.482Z","repository":{"id":286844738,"uuid":"952460036","full_name":"github/audit-actions-workflow-runs","owner":"github","description":"Audit your GitHub Actions workflow runs to see exactly which Actions were downloaded","archived":false,"fork":false,"pushed_at":"2025-04-08T17:01:15.000Z","size":165,"stargazers_count":18,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-04-08T17:22:21.384Z","etag":null,"topics":["actions-workflows","appsec","audit","audit-log","devsecops","github-actions","supply-chain-security"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/github.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":"audit_workflow_runs.js","citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":"SUPPORT.md","governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-03-21T10:10:02.000Z","updated_at":"2025-04-08T17:01:19.000Z","dependencies_parsed_at":"2025-04-08T17:22:30.931Z","dependency_job_id":"ab821bda-4a13-4454-ae9d-822c2e2f6345","html_url":"https://github.com/github/audit-actions-workflow-runs","commit_stats":null,"previous_names":["github/audit-actions-workflow-runs"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Faudit-actions-workflow-runs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Faudit-actions-workflow-runs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Faudit-actions-workflow-runs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Faudit-actions-workflow-runs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/github","download_url":"https://codeload.github.com/github/audit-actions-workflow-runs/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248746684,"owners_count":21155313,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["actions-workflows","appsec","audit","audit-log","devsecops","github-actions","supply-chain-security"],"created_at":"2025-04-15T06:10:18.123Z","updated_at":"2025-10-23T16:34:57.348Z","avatar_url":"https://github.com/github.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Audit GitHub Actions used in workflow runs for an organization, Enterprise or repository\n\nDiscover which versions of GitHub Actions were used in workflow runs, down to the exact commit.\n\nChecks the audit log for a GitHub Enterprise/organization (or just lists the runs, for a repository) for workflow runs created between the start date and end date.\n\nLists the Actions and specific versions and commits used in them.\n\nOptionally, filters by particular Actions, possibly including one or more commit SHAs of interest.\n\n\u003e [!NOTE]\n\u003e This is an _unofficial_ tool created by Field Security Specialists, and is not officially supported by GitHub.\n\n## Usage\n\nClone this repository locally.\n\nFor all scripts, you must set a `GITHUB_TOKEN` in the environment with appropriate access to the audit log on your org or Enterprise, or the repository you are interested in. It can be convenient to use the [`gh` CLI](https://cli.github.com/) to get a token, with [`gh auth login`](https://cli.github.com/manual/gh_auth_login) and [`gh auth token`](https://cli.github.com/manual/gh_auth_token).\n\nFor Enterprise Server or Data Residency users, please set `GITHUB_BASE_URL` in your environment, e.g. `https://github.acme-inc.example/api/v3`.\n\n### audit_workflow_runs.js\n\n```text\nnode audit_workflow_runs.js \u003corg or enterprise name\u003e \u003cent|org|repo\u003e \u003cstart date\u003e \u003cend date\u003e [\u003coutput-file\u003e] [\u003cinput-filters-file\u003e]\n```\n\nResults are printed to the console in CSV, for convenience, and also appended to a single-line JSON file in the current directory. This is named `workflow_audit_results.sljson` by default, and can be set with the optional `output-file` parameter.\n\nThe CSV output has the headers:\n\n```csv\norg,repo,workflow,run_id,created_at,name,version,sha\n```\n\nBy default all Actions are listed, but you can filter by particular Actions using a JSON formatted input file.\n\nFor example:\n\n```bash\nnode audit_workflow_runs.js github org 2025-03-13 2025-03-15 github_actions_audit.sljson\n```\n\n```bash\nnode audit_workflow_runs.js github org 2025-03-13 2025-03-15 github_actions_audit.sljson actions_to_find.json\n```\n\n#### JSON input file format\n\nThe JSON input file should an object with the keys being the name of the Action, and the value being an array of the commits you are interested in.\n\nUse the Action name in the format `owner/repo` or `owner/repo/path`, where `path` can contain any number of slashes.\n\nYou can express some wildcards - use `*` after the first `/` in the Action to include all repositories under the owner, and use `*` in the commit array (or leave it empty) to include all commits.\n\nAn Action name given without a path will match any Action in that repository, whether or not it has a path. You can also explictly use `*` in the path to match any path.\n\n```json\n{\n    \"actions/setup-node\": [\"*\"],\n    \"actions/checkout\": [\"*\"],\n    \"actions/setup-python\": [\"0000000000000000000000000000000000000000\"],\n} \n```\n\n### find_compromised_secrets.js\n\n\u003e [!NOTE]\n\u003e This is relevant only to secrets leaked because of the `tj-actions/changed-files` and `reviewdog` compromises in March 2025.\n\nThis script takes the structured single-line JSON output of `audit_workflow_runs.js` (not the convenience CSV output) and searches for secrets in the format that was leaked in those workflow runs (doubly base64 encoded, with predictable content).\n\n```text\nnode find_compromised_secrets.js \u003c \u003cpath sljson file\u003e\n```\n\nResults are printed to the console, and written to a file in the current directory, named `compromised_secrets.sljson`.\n\nFor example:\n\n```bash\nnode find_compromised_secrets.js \u003c workflow_audit_results.sljson\n```\n\n## License\n\nThis project is licensed under the terms of the MIT open source license. Please refer to the [LICENSE](LICENSE) for the full terms.\n\n## Maintainers\n\nSee [CODEOWNERS](CODEOWNERS) for the list of maintainers.\n\n## Support\n\n\u003e [!NOTE]\n\u003e This is an _unofficial_ tool created by Field Security Specialists, and is not officially supported by GitHub.\n\nSee the [SUPPORT](SUPPORT.md) file.\n\n## Background\n\nSee the [CHANGELOG](CHANGELOG.md), [CONTRIBUTING](CONTRIBUTING.md), [SECURITY](SECURITY.md), [SUPPORT](SUPPORT.md), [CODE OF CONDUCT](CODE_OF_CONDUCT.md) and [PRIVACY](PRIVACY.md) files for more information.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithub%2Faudit-actions-workflow-runs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgithub%2Faudit-actions-workflow-runs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithub%2Faudit-actions-workflow-runs/lists"}