wrdn-gha-workflows

To find exploitable GitHub Actions workflow vulnerabilities, trace entry points from triggers to sinks across .github/workflows and action.yml files. This identifies expression-injection, pwn-request patterns, and unsafe input handling with structured remediation guidance.

A pwn-request pattern in GitHub Actions occurs when privileged PR contexts process untrusted input from forks, exposing secrets. Analyzing triggers and token scopes maps attacker-controlled paths to detect these expression-injection and TOCTOU risks.

Audit GitHub Actions workflow_call and workflow_dispatch inputs by validating unsafe input handling and tracking entry points to sinks. Apply this to diffs touching reusable workflows, local actions, and scripts to map attacker-controlled paths.

Yes, this workflow security audit covers reusable workflows and local actions. It tracks entry points, inputs, sinks, and token scopes across .github/workflows, action.yaml, scripts, and artifacts to output structured findings with remediation guidance.

The best way to detect TOCTOU issues and expression-injection in GitHub Actions workflows is to trace untrusted inputs from triggers to sinks. Mapping privileged PR contexts and secret scopes reveals exploitable patterns for targeted remediation.

Scan .github/workflows for privileged PR contexts and token scopes during code reviews or when diffs touch CI/CD workflows. This validates prerun protections and identifies exposure of secrets before merging changes.