{"uid":"cap_CTNE1v-GTr-qiDfyi8tWf","slug":"ci-workflow-audit-87bb9586","name":"CI Workflow Audit","description":"Audit a CI workflow for what it leaves movable or undeclared. Reports actions pinned to a tag rather than a commit - a tag can be moved by whoever owns the action, so the code a step runs can change without this file changing - missing permissions and timeouts, a job depending on one that is not declared, a pull_request_target trigger, and an expression interpolated straight into a shell command.","url":"https://api.zfinia.com/x402/v1/ci-workflow-contract-audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"contract":{"type":"object","properties":{"required_jobs":{"type":"array","items":{"type":"string","maxLength":128},"maxItems":200,"minItems":1},"require_timeout":{"type":"boolean"},"require_permissions":{"type":"boolean"},"require_pinned_actions":{"type":"boolean"},"forbid_pull_request_target":{"type":"boolean"}},"additionalProperties":false},"workflow":{"type":"object"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.12","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.12/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.12","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.12","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm__Q-UAkUopqS3Ajt4m_EsP","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.12","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits a GitHub Actions CI workflow file for security and reliability issues: unpinned actions, missing permissions/timeouts, undeclared job dependencies, dangerous trigger events, and shell injection risks.","exampleAgentPrompt":"Audit this GitHub Actions workflow for security issues — flag any actions pinned to a tag instead of a commit SHA, missing job-level permissions or timeouts, any use of pull_request_target, shell injection from expression interpolation, and make sure these jobs are all declared: [build, test, deploy].","exampleUseCases":[{"title":"Pre-merge workflow security gate","prompt":"Before I merge this PR, audit the GitHub Actions workflow for any unpinned action references, missing permissions, missing timeouts, and check whether it uses pull_request_target — I need to know if it's safe to merge."},{"title":"Supply chain hardening audit","prompt":"Can you check our CI workflow and flag every action that's pinned to a tag rather than a commit SHA? I want to lock down our supply chain so nobody can silently change what code runs in our pipeline."},{"title":"Shell injection risk scan","prompt":"Scan this workflow file for any places where a GitHub Actions expression like ${{ github.event.issue.title }} is interpolated directly into a shell command — I want to know if we're vulnerable to injection attacks."}],"resultDescription":"A structured report listing: actions pinned to mutable tags (not commit SHAs) with step identifiers; jobs missing explicit permissions declarations; jobs missing timeout-minutes; job dependency edges referencing undeclared jobs; presence of pull_request_target trigger; and shell commands containing direct expression interpolation. Each finding references the relevant job or step for remediation.","failureModes":["Invalid or unparseable workflow object — returns validation error","required_jobs list references jobs not present in the workflow — flagged as missing dependency","Empty workflow object — may return no findings or schema error","Malformed contract object (unknown fields rejected due to additionalProperties: false)","Payment failure (x402) — 402 response if USDC payment not included"],"whenToPreferThis":"Choose this endpoint when you need a fast, automated security audit of a GitHub Actions workflow file focused specifically on supply-chain and privilege-escalation risks: unpinned actions, missing permissions/timeouts, dangerous triggers, and shell injection. It is purpose-built for CI workflow contracts rather than generic SAST tools, and supports declarative contracts (required jobs, pinning/timeout/permission requirements) so you can enforce org-wide policies programmatically.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T18:44:43.635Z","isFirstParty":false,"canonicalSlug":"ci-workflow-audit-87bb9586"}