chiz0me/actions-warden
Audit, pin, and upgrade GitHub Actions workflows. LLM-friendly TOON output, safe-by-default.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| command | Subcommand to run: audit | pin | upgrade | report | rules | no | audit |
| workflow | Workflow path or glob (space-separated for multiple). Defaults to .github/workflows/*.yml | no | "" |
| severity | Minimum severity to report (audit/report): low | medium | high | critical | no | "" |
| format | Output format: toon | json | text | no | toon |
| mode | Upgrade scope (upgrade/report): major | minor | patch | no | minor |
| min-age | Cooldown in days before accepting a new tag (upgrade/report). Default 7. | no | 7 |
| write | For pin/upgrade: apply changes (true) instead of dry-run (false). | no | false |
| explain | For audit: include plain-English remediation hint per finding. | no | false |
| offline | For report: skip network calls (audit only). | no | false |
| output-path | Write output to this file in addition to stdout. | no | "" |
| token | GitHub API token. Pass github.token from the calling workflow. | no | "" |
| working-directory | Directory to scan. Defaults to GITHUB_WORKSPACE. | no | "" |
| node-version | Node.js version to install. | no | 20 |
Outputs
| name | description |
|---|---|
| status | OK or FAIL |
| findings | Number of audit findings (audit/report only). |
| report-path | Absolute path of the written report file, if output-path was set. |