An open API service indexing awesome lists of open source software.

https://github.com/rogerchappel/actionpin

Local-first GitHub Actions workflow risk checker.
https://github.com/rogerchappel/actionpin

ci github-actions security supply-chain typescript workflow-scanner

Last synced: about 2 months ago
JSON representation

Local-first GitHub Actions workflow risk checker.

Awesome Lists containing this project

README

          

# ActionPin 📌

ActionPin is a tiny local-first GitHub Actions workflow checker. It looks for the stuff that quietly turns CI into supply-chain confetti: unpinned actions, broad token permissions, secret-looking literals, risky `pull_request_target`, and shell steps that fetch the internet straight into `bash`.

It is boring on purpose: deterministic, offline, no telemetry, no GitHub API required.

## Install

```bash
npm install
npm run build
node dist/src/cli.js rules
```

When published, the CLI is exposed as `actionpin`.

## Quick start

```bash
actionpin scan .github/workflows --out actionpin-report.md
actionpin scan fixtures/bad-workflows --format json --fail-on medium
actionpin rules
```

For local development in this repo:

```bash
npm run build
node dist/src/cli.js scan fixtures/bad-workflows --format json --fail-on high
```

## Rules

- `actions.unpinned` — third-party `uses:` references must be pinned to a full 40-character commit SHA.
- `permissions.missing` — top-level `permissions:` should be explicit.
- `permissions.broad` — `write-all`, `read-all`, and broad top-level write permissions are risky.
- `secrets.plaintext` — secret-looking literal values should not live in workflow YAML.
- `events.pull_request_target` — privileged PR workflows need careful review.
- `shell.curl-bash` — piping remote content into `bash`/`sh` is flagged.
- `shell.insecure-flags` — patterns like `set +e`, `curl -k`, and `wget --no-check-certificate` are flagged.

## Configuration

Create `actionpin.config.json` or pass `--config`:

```json
{
"failOn": "medium",
"format": "markdown",
"ignoreRules": ["events.pull_request_target"]
}
```

Inline allow comments are supported for narrow exceptions:

```yaml
# actionpin allow: actions.unpinned
- uses: actions/labeler@v5
```

Use them sparingly and leave a human-readable comment nearby.

## Safety model

ActionPin only reads workflow paths you ask it to scan, refuses paths outside the repo root, writes only when `--out` is provided, and never performs network calls while scanning. Reports include stable file/line/snippet evidence and remediation text.

## CI usage

```yaml
- run: npm ci
- run: npm run build
- run: node dist/src/cli.js scan .github/workflows --fail-on high
```

Use Markdown output for PR artifacts and JSON output for bots or release evidence.

## Limitations

ActionPin is not a full YAML interpreter or shell static analyzer. It intentionally catches common, review-worthy patterns without trying to prove a workflow is safe. It does not resolve action metadata, verify SHAs, or inspect remote repositories.

## Development

```bash
npm test
npm run check
npm run build
npm run smoke
bash scripts/validate.sh
```

See `docs/PRD.md` and `docs/TASKS.md` for the MVP contract.