ci-workflow-linter

To audit GitHub Actions workflows for security flaws, you can run a CI workflow linter that scans for secret-leak risks, third-party action pinning, and GITHUB_TOKEN permissions. It generates a read-only, structured report with citations and remediation guidance.

When checking CI pipeline security risks in GitLab CI and Jenkins, look for untrusted-input handling, expression injection via PR titles, OIDC federation setup, and self-hosted runner config. A dedicated linter can identify these misconfigurations and provide live guidance from OpenSSF Scorecard and OWASP CI/CD Top 10.

Yes, this CI workflow linter supports CircleCI, Buildkite, and Azure Pipelines. It is applicable to these platforms alongside GitHub Actions, GitLab CI, and Jenkins workflows across both public and private repos to enforce security hygiene and timeout discipline.

To enforce least-privilege GITHUB_TOKEN permissions and third-party action pinning (SHA vs mutable tag) in your CI pipelines, run a read-only security linter. It evaluates your workflow configurations against the StepSecurity catalog and outputs explicit remediation steps.

CI workflow expression injection vulnerabilities from PR titles occur when untrusted input is improperly evaluated in workflow scripts. A pipeline security linter detects this risk by checking untrusted-input handling and provides citations from GitHub Actions security-hardening docs for remediation.

The best way to check for secret-leak risks (like token echo or env print) and cache-key staleness in CI pipelines is using an automated linter. It performs read-only analysis to identify these hygiene issues and concurrent-run handling flaws, producing a reproducible structured report.