pwideman/Find Sha1-Hulud Activity
Custom action to look for potential Sha1-Hulud activity in GitHub Organization audit logs
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| org | The name of the GitHub Organization to query audit logs for | yes | — |
| app-id | GitHub App ID for authentication | yes | — |
| app-installation-id | GitHub App Installation ID for authentication | yes | — |
| app-private-key | GitHub App private key for authentication | yes | — |
| days-back | Number of days to search back in audit logs | no | 7 |
| time-window | Time window in seconds within which all 3 workflow events must occur to be flagged | no | 60 |
| output-dir | Directory path to write the CSV file containing suspicious activity details (can be relative or absolute) | no | . |
| additional-phrase | Additional GitHub audit log search phrase to combine with the action-generated search (e.g., to filter by user or repository) | no | "" |
| context-search-minutes | Number of minutes to search before and after suspicious activity for additional audit log context | no | 10 |
Outputs
| name | description |
|---|---|
| suspicious-actors-count | Number of actors with suspicious activity found |
| suspicious-activities-count | Total number of suspicious activity sequences found |