github-actions-supply-chain

What problem does it solve?

Provides a structured checklist and guidance to find and remediate supply-chain and security weaknesses in GitHub Actions workflows, reducing the risk of secret exfiltration and malicious code execution via CI.

Core Features & Use Cases

• SHA pinning enforcement: Ensure every uses: reference is pinned to a full 40-character commit SHA and retain the human-readable tag as a comment.
• Third-party action risk identification: Flag actions outside the actions/ and github/ namespaces and classify their risk.
• Permissions and trigger hardening: Verify minimal permissions blocks, detect unsafe pull_request_target usage, and find user-controlled inputs that flow into run: commands.
• Maintenance automation: Check for dependabot or Renovate configuration to keep pinned SHAs up to date.
• Use Case: Run this checklist during repository security reviews, CI hardening sprints, or pre-release audits to produce a prioritized findings table and remediation plan.

Quick Start

Run a supply chain assessment across the repository's .github/workflows directory and report any actions not pinned to commit SHAs, workflows missing minimal permissions, or unsafe pull_request_target usage.