--workflow-audits.
Checks
Supply chain
Detects unpinned external action references (
uses: owner/repo@tag instead of a full commit SHA), archived action references, stale action refs, floating action version tags, and — in online mode — known-vulnerable action references from the advisory registry.Dangerous triggers
Flags high-risk workflow trigger events:
pull_request_target and workflow_run. These triggers run in the context of the base repository even when initiated by a fork, and can grant untrusted code write permissions if not carefully guarded.Overly broad permissions
Reports
write-all permission grants and explicit write grants on sensitive scopes. Also covers undocumented permissions blocks, overprovisioned secrets, secrets: inherit usage, and secrets referenced outside of environment blocks.Template expression injection
Detects
${{ }} template expressions that interpolate untrusted context values (such as github.event.pull_request.title or github.head_ref) directly into run: steps or known sink inputs. Template injection is a common code-execution path in compromised workflows.Dependabot checks
Cooldown checks flag Dependabot PRs merged before a configurable settling period. Execution-risk checks flag Dependabot configurations that allow auto-merge of updates with elevated execution risk. Auto-merge policy detection is also included.
Workflow hygiene
Covers concurrency gate absence (workflows that can run concurrent instances unexpectedly), obfuscation patterns in workflow definitions, unsafe conditional trust (
if: conditions that can be bypassed), unsound contains() usage, bot-condition bypasses, and other hygiene signals.Collection modes
The--collect flag controls which artifact scope is included for auditing. It is repeatable.
Collection kinds
The--collect-kind flag restricts collection to specific artifact types. It is repeatable.
Personas
The--persona flag adjusts audit sensitivity. Higher personas enable more checks.
Runtime modes
The--runtime-mode flag controls whether checks that require network access are enabled.
Strict collection
Use--strict-collection to treat parse failures in collected workflow or action inputs as high-severity findings rather than silently skipping unparseable files: