gha-audit

Scan .github/workflows/*.yml for known GitHub Actions supply-chain and CI security misconfigurations, before they become an incident.

pip install gha-audit
gha-audit .

What it catches

All four are static, deterministic checks with no network access beyond reading files already in your checkout — gha-audit never executes or fetches the actions it inspects.

Usage

gha-audit .                # scan the current repo, human-readable output
gha-audit path/to/repo     # scan a different path
gha-audit --json .         # machine-readable output
gha-audit --strict .       # also fail (non-zero exit) on 'warn' findings, not just 'error'

Exit code is 0 when nothing is found (or only warn-level findings without --strict), 1 when an error-level finding exists.

(gha-audit . is shorthand for gha-audit scan . — both work.)

Pro: HTML audit report

The scan above is free and unrestricted. For a standalone HTML report you can hand to a reviewer, attach to a PR, or archive for a security audit, gha-audit report is a paid feature ($49, one-time license key):

gha-audit report . --license-key <KEY> -o audit.html

Unlock it here: https://buy.stripe.com/PLACEHOLDER_GHA_AUDIT_PRO (the key can also be set via the GHA_AUDIT_KEY environment variable instead of --license-key). The free gha-audit scan behavior is completely unaffected — only the report export is gated.

Accuracy

Measured against a labelled fixture corpus (tests/test_accuracy.py), each fixture isolated to exercise exactly one check:

• Recall: 100.00% (8/8 known-vulnerable fixtures detected)
• False-positive rate: 0.00% (0/7 known-safe fixtures flagged)

Numbers are transcribed from the test harness's own output, not narrated.

What it doesn't do (yet)

• Trigger-aware permissions analysis (e.g. flagging contents: write specifically when combined with pull_request_target) — only the unambiguous write-all case is checked today.
• Traversal into reusable/composite workflows (workflow_call).
• Pinning checks for docker:// actions.

License

MIT. Author: HiroCheck.