twinsunllc/GitHub Actions Security Checker
Checks GitHub Actions for security best practices: verified publishers and commit hash pinning
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| github_token | GitHub token for API access to check verified publishers | yes | ${{ github.token }} |
| workflows_dir | Directory containing workflow files to audit | no | .github/workflows |
| whitelist | List of allowed namespaces or repositories. Can be comma-separated or newline-separated. | no | "" |
| blacklist | List of blocked namespaces or repositories. Can be comma-separated or newline-separated. Blacklist takes precedence over whitelist. | no | "" |
| allowlist | List of trusted namespaces or repositories that bypass verified publisher checks but still require commit hash pinning. Can be comma-separated or newline-separated. | no | "" |
Outputs
| name | description |
|---|---|
| report | Security audit report in Markdown format |
| exit_code | Exit code (0 for pass, 1 for fail) |
| passed | Boolean indicating if all checks passed |