gha-audit 0.1.2

Scan .github/workflows for known GitHub Actions supply-chain and CI security misconfigurations (unpinned actions, pwn requests, script injection, over-broad permissions).

gha-audit

Scan .github/workflows/*.yml for known GitHub Actions supply-chain and CI security misconfigurations, before they become an incident.

pip install gha-audit
gha-audit .

What it catches

Check	Severity	Real-world pattern
unpinned-action	warn	uses: owner/repo@main (or any tag) instead of a full commit SHA. A mutable ref can be repointed to run different code without a corresponding change in your repo to review — this is exactly how the tj-actions/changed-files compromise played out in 2025.
pull-request-target-checkout	error	A workflow triggers on pull_request_target (runs with your repo's secrets and write token) and checks out the pull request's own head. A fork's PR can then run its own code with your secrets — the canonical "pwn request" pattern.
script-injection	error	A run: step interpolates ${{ github.event.issue.title }} (or PR title/body, comment body, github.head_ref, ...) directly into the shell command. These values are attacker-controlled and are substituted as raw text before the shell runs — arbitrary shell input is possible.
broad-permissions	warn	Top-level permissions: write-all. GitHub's own hardening guide recommends the opposite: grant only the specific scopes each job needs.

All four are static, deterministic checks with no network access beyond reading files already in your checkout — gha-audit never executes or fetches the actions it inspects.

Usage

gha-audit .                # scan the current repo, human-readable output
gha-audit path/to/repo     # scan a different path
gha-audit --json .         # machine-readable output
gha-audit --strict .       # also fail (non-zero exit) on 'warn' findings, not just 'error'

Exit code is 0 when nothing is found (or only warn-level findings without --strict), 1 when an error-level finding exists.

(gha-audit . is shorthand for gha-audit scan . — both work.)

Pro: HTML audit report

The scan above is free and unrestricted. For a standalone HTML report you can hand to a reviewer, attach to a PR, or archive for a security audit, gha-audit report is a paid feature ($49, one-time license key):

gha-audit report . --license-key <KEY> -o audit.html

Unlock it here: https://buy.stripe.com/6oU9AU3xigSZedP90WdMI03 (the key can also be set via the GHA_AUDIT_KEY environment variable instead of --license-key). The free gha-audit scan behavior is completely unaffected — only the report export is gated.

Accuracy

Measured against a labelled fixture corpus (tests/test_accuracy.py), each fixture isolated to exercise exactly one check:

• Recall: 100.00% (8/8 known-vulnerable fixtures detected)
• False-positive rate: 0.00% (0/7 known-safe fixtures flagged)

Numbers are transcribed from the test harness's own output, not narrated.

What it doesn't do (yet)

• Trigger-aware permissions analysis (e.g. flagging contents: write specifically when combined with pull_request_target) — only the unambiguous write-all case is checked today.
• Traversal into reusable/composite workflows (workflow_call).
• Pinning checks for docker:// actions.

License

MIT. Author: HiroCheck.