gha-security-review

To check your GitHub Actions workflows for security vulnerabilities, perform a security review to analyze workflow configurations and code for common attack vectors like pwn requests and expression injection, categorizing potential security issues by severity and exploitability.

A pwn request is a common attack vector in GitHub Actions workflow security where an external user triggers a workflow with malicious payloads, potentially escalating credentials or poisoning config files. Identifying this risk requires analyzing workflow configuration triggers and code execution paths.

Yes, you need GitHub API access to perform a workflow security review. Accessing the API is a prerequisite for analyzing workflow configurations and code, identifying vulnerabilities like expression injection, and evaluating permission scopes and secret management practices.

To prevent expression injection in GitHub Actions config files, perform a targeted security review to identify and mitigate untrusted input being evaluated in workflow expressions, applying best practice recommendations for securing permissions and managing secrets safely.

Auditing GitHub Actions for credential escalation requires knowledge of GitHub Actions configuration and focuses on common attack vectors. Limitations include the need for GitHub API access and the necessity of understanding permission scopes and secret management to accurately identify and categorize exploitability.