kryptorious-wfguard

Lint GitHub Actions workflows for CI-breaking and supply-chain issues — no Go install required.

wfguard is a native Python CLI that catches the workflow mistakes that break CI or weaken your supply-chain posture before they merge. It parses .github/workflows/*.yml — no actionlint (Golang) dependency, runs anywhere Python runs, offline.

Pairs naturally with the 15 Kryptorious GitHub Actions you can drop in.

Install

pip install kryptorious-wfguard

Usage

# Lint all workflows under the current repo
wfguard check

# In CI — fail the build on any error-severity issue
wfguard check --fail-on error

# Machine-readable output
wfguard check --json
wfguard check --sarif > wfguard.sarif

# Catch warnings too (moving refs, missing shell, duplicate names)
wfguard check --fail-on warning

# Just enumerate discovered workflow files
wfguard list

What it catches

Why not just use actionlint?

actionlint is excellent but ships as a Go binary — another toolchain to install and pin in CI, and it doesn't run on every platform out of the box in a Python shop. wfguard is one pip install, drops into a Python project's existing test/CI flow, and emits JSON or SARIF so you can gate on it directly.

CI example

# .github/workflows/wf-lint.yml
name: Workflow Lint
on: [pull_request]
jobs:
  wfguard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: '3.12' }
      - run: pip install kryptorious-wfguard
      - run: wfguard check --fail-on error

License

MIT — free for any use. Part of the 31-tool Kryptorious Developer Suite ($9 lifetime, DevFlow Premium included).