ci-pipeline-checker

What problem does it solve?

CI/CD pipelines are the most targeted supply chain layer for modern software projects, with recent high-profile CVEs exploiting unpinned action tags, overly permissive permissions, and missing security controls to leak secrets, compromise codebases, and gain unauthorized access to cloud infrastructure. Manual audits of pipeline configurations are time-consuming and often miss subtle, high-risk misconfigurations that expose teams to avoidable attacks.

Core Features & Use Cases

• Multi-platform CI auditing: Validates GitHub Actions, GitLab CI, CircleCI, Buildkite and other major CI platforms for supply chain security, least-privilege hygiene, secrets handling, and build-provenance integrity.
• Threat detection and triage: Flags critical and high-severity issues including unpinned action tags (CVE-2025-30066 class), permissions: write-all misconfigurations, plaintext secrets in workflow files, unsafe pull_request_target triggers, and missing SLSA build provenance, with clear, actionable fixes for each finding.
• Compliance and best practice enforcement: Checks for required status checks on protected branches, push-protection secret scanning, OIDC federation for cloud credentials, ephemeral runner requirements, and concurrency/timeout controls aligned with 2026 industry standards.
• Use case: A DevOps engineer can use this skill to audit their team's GitHub Actions workflows before a production release, identifying unpinned third-party actions and missing OIDC configuration to prevent supply chain compromises and secret leaks.

Quick Start

Use the ci-pipeline-checker skill to audit your repository's CI/CD pipeline configurations for security vulnerabilities and 2026 best practice compliance.