indoor47/Workflow Security Hardener
Scan GitHub Actions workflows for security issues: unpinned actions, broad permissions, script injection, insecure checkout
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| fail_on | Fail if findings at this severity or above. Options: critical, high, medium, low, none | no | critical |
| format | Output format: text, json, markdown, sarif | no | text |
| fix | Auto-fix unpinned actions by pinning to commit SHAs | no | false |
| github_token | GitHub token for SHA resolution (needed for --fix). Defaults to github.token | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| score | Security score (0-100) |
| findings-count | Number of security issues found |
| findings | Full findings in JSON format |
| sarif-file | Path to SARIF file (when format=sarif) |
| fixed-count | Number of issues auto-fixed (when fix=true) |