mshade/flowscope-static-analysis-gate
Analyzes GitHub Actions workflow files for permission scope violations. Hard-blocks write-all, implicit full access, and unscoped workflow-level writes. Warns on agentic steps with write scope and no observed baseline.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| workflow_file | Path to the workflow YAML file to analyze | yes | — |
| baseline_file | Path to JSON file with observed usage baseline (from observation plane) | no | "" |
| exceptions_file | Path to JSON file with registered scope exceptions | no | "" |
| create_exception_pr | When true, automatically create a draft PR with an exception skeleton when violations are detected. Requires contents: write and pull-requests: write permissions in the calling workflow. | no | false |
| warn_only | When true, exit 0 even when violations are found. Prints an audit summary of what would have failed. Use during gradual rollout before enabling hard enforcement. | no | false |
| registry_url | URL to POST violations JSON for central audit tracking. Intended for the policy plane (not yet implemented). Can also be set via the FLOWSCOPE_REGISTRY_URL environment variable. | no | "" |
Outputs
| name | description |
|---|---|
| result | Full JSON check result (workflow_path, passed, violations[]) |