https://github.com/rogerchappel/actionpin
Local-first GitHub Actions workflow risk checker.
https://github.com/rogerchappel/actionpin
ci github-actions security supply-chain typescript workflow-scanner
Last synced: about 2 months ago
JSON representation
Local-first GitHub Actions workflow risk checker.
- Host: GitHub
- URL: https://github.com/rogerchappel/actionpin
- Owner: rogerchappel
- License: mit
- Created: 2026-05-11T08:40:57.000Z (2 months ago)
- Default Branch: main
- Last Pushed: 2026-05-19T20:33:40.000Z (2 months ago)
- Last Synced: 2026-05-19T23:59:00.466Z (2 months ago)
- Topics: ci, github-actions, security, supply-chain, typescript, workflow-scanner
- Language: TypeScript
- Homepage:
- Size: 49.8 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md
- Roadmap: ROADMAP.md
- Agents: AGENTS.md
Awesome Lists containing this project
README
# ActionPin 📌
ActionPin is a tiny local-first GitHub Actions workflow checker. It looks for the stuff that quietly turns CI into supply-chain confetti: unpinned actions, broad token permissions, secret-looking literals, risky `pull_request_target`, and shell steps that fetch the internet straight into `bash`.
It is boring on purpose: deterministic, offline, no telemetry, no GitHub API required.
## Install
```bash
npm install
npm run build
node dist/src/cli.js rules
```
When published, the CLI is exposed as `actionpin`.
## Quick start
```bash
actionpin scan .github/workflows --out actionpin-report.md
actionpin scan fixtures/bad-workflows --format json --fail-on medium
actionpin rules
```
For local development in this repo:
```bash
npm run build
node dist/src/cli.js scan fixtures/bad-workflows --format json --fail-on high
```
## Rules
- `actions.unpinned` — third-party `uses:` references must be pinned to a full 40-character commit SHA.
- `permissions.missing` — top-level `permissions:` should be explicit.
- `permissions.broad` — `write-all`, `read-all`, and broad top-level write permissions are risky.
- `secrets.plaintext` — secret-looking literal values should not live in workflow YAML.
- `events.pull_request_target` — privileged PR workflows need careful review.
- `shell.curl-bash` — piping remote content into `bash`/`sh` is flagged.
- `shell.insecure-flags` — patterns like `set +e`, `curl -k`, and `wget --no-check-certificate` are flagged.
## Configuration
Create `actionpin.config.json` or pass `--config`:
```json
{
"failOn": "medium",
"format": "markdown",
"ignoreRules": ["events.pull_request_target"]
}
```
Inline allow comments are supported for narrow exceptions:
```yaml
# actionpin allow: actions.unpinned
- uses: actions/labeler@v5
```
Use them sparingly and leave a human-readable comment nearby.
## Safety model
ActionPin only reads workflow paths you ask it to scan, refuses paths outside the repo root, writes only when `--out` is provided, and never performs network calls while scanning. Reports include stable file/line/snippet evidence and remediation text.
## CI usage
```yaml
- run: npm ci
- run: npm run build
- run: node dist/src/cli.js scan .github/workflows --fail-on high
```
Use Markdown output for PR artifacts and JSON output for bots or release evidence.
## Limitations
ActionPin is not a full YAML interpreter or shell static analyzer. It intentionally catches common, review-worthy patterns without trying to prove a workflow is safe. It does not resolve action metadata, verify SHAs, or inspect remote repositories.
## Development
```bash
npm test
npm run check
npm run build
npm run smoke
bash scripts/validate.sh
```
See `docs/PRD.md` and `docs/TASKS.md` for the MVP contract.