{"uid":"cap_GDqdALBSe0k8wk3wzXe70","slug":"github-actions-workflow-security-linter-e827fae5","name":"GitHub Actions Workflow Security Linter","description":"Lint a GitHub Actions workflow: actions not pinned to a commit SHA, missing or write-all permissions, pull_request_target with PR head checkout, script injection via event fields in run, secrets on the command line, curl|bash, self-hosted runners, deprecated set-output.","url":"https://ciaudit.genexxis.com/github-actions?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"content":{"type":"string","description":"Full text of the file (max 100 KB)"}}},"responseSchema":{"type":"json","example":{"jobs":["test"],"kind":"github-actions","score":76,"summary":{"low":0,"high":0,"total":3,"medium":3},"findings":[{"id":"no_permissions","fix":"Add at top level: permissions: { contents: read }","why":"no top-level permissions: the GITHUB_TOKEN gets the repository default","line":null,"snippet":null,"severity":"medium"},{"id":"unpinned_action","fix":"Pin to a full commit SHA","why":"actions/checkout is referenced by a mutable tag/branch","line":10,"snippet":"- uses: actions/checkout@v4","severity":"medium"}],"triggers":["push","pull_request"]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.008","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_daHsLy7eMkvuEpe4stOCh","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits a GitHub Actions workflow file for common security misconfigurations and vulnerabilities, returning scored findings with severity, fix suggestions, and affected lines.","exampleAgentPrompt":"Can you audit my GitHub Actions workflow for security issues — here's the full YAML content — and tell me what's misconfigured, the severity of each finding, and how to fix it?","exampleUseCases":[{"title":"Pre-merge CI workflow security gate","prompt":"Before we merge this PR, run our GitHub Actions workflow YAML through a security audit and flag anything risky — especially unpinned actions, missing permissions, or script injection vulnerabilities."},{"title":"Supply chain hardening for open-source project","prompt":"We're hardening our open-source repo's CI pipeline. Can you lint this GitHub Actions workflow file and tell me which actions aren't pinned to a commit SHA and what our overall security score is?"},{"title":"Detecting pull_request_target misuse","prompt":"I think our workflow might be vulnerable to a pull_request_target attack where we check out the PR head. Can you analyze this workflow YAML and confirm whether that risk exists and how to fix it?"}],"resultDescription":"Returns a JSON object containing: a numeric security score (0-100), a summary of findings broken down by severity (high/medium/low/total), a list of detailed findings each with an ID, severity, why it matters, a specific fix suggestion, the affected line number, and a code snippet. Also includes the list of workflow triggers and job names detected.","failureModes":["Workflow YAML exceeds 100 KB limit — content will be rejected","Malformed or non-YAML content submitted — may produce empty or incorrect findings","Non-GitHub-Actions YAML (e.g. GitLab CI, CircleCI) — may misclassify or return irrelevant results","Payment failure via x402 protocol — request not processed","Network timeout for very complex workflows"],"whenToPreferThis":"Use this endpoint when you need automated, structured security feedback on a GitHub Actions workflow file specifically — it covers a targeted set of CI/CD security checks (pinning, permissions, injection, secrets, curl|bash, self-hosted runners, deprecated commands) with per-finding fix guidance and a numeric score. Prefer this over generic SAST tools when you want fast, cheap, focused CI-security linting without setting up a full scanning pipeline.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-29T12:34:33.075Z","isFirstParty":false,"canonicalSlug":"github-actions-workflow-security-linter-e827fae5"}