wrdn-gha-workflows

Detect GitHub Actions workflow vulnerabilities by tracing untrusted data from triggers like pull_request_target to privileged contexts. Map end-to-end exploit chains where attacker-controlled inputs reach steps, enabling code execution or secret leakage. Structured findings include entry points, sinks, and remediation guidance.

A GitHub Actions workflow is exploitable through pull_request_target when untrusted pull request data flows into privileged steps without proper trust boundaries. This allows attacker-controlled inputs to influence commands or secrets, enabling code execution or credential exposure during the workflow run.

Audit reusable workflows for supply-chain risks by evaluating workflow_call and workflow_dispatch triggers, inputs, and sinks. Trace how inputs influence commands, secrets, or tokens across single-repo and reusable-callee scenarios to identify exploitable defects and suggest concrete hardening steps.

Yes, this workflow audit approach evaluates workflows triggered by workflow_call and workflow_dispatch where inputs can influence commands, secrets, or tokens. It assesses trust boundaries and step boundaries across both single-repo and reusable-callee scenarios to produce structured findings.

Detecting GitHub Actions security defects requires evaluating triggers, trust boundaries, inputs, and sinks across single-repo and reusable-callee scenarios. It focuses on untrusted data reaching privileged contexts but relies on documented references to distinguish safe patterns from exploit patterns and calibrate severity accurately.