GitHub Actions Security Checker — Scan Workflows for Supply Chain Vulnerabilities

The most exploited GitHub Actions misconfigurations

• pull_request_target + checkout (Critical): This is the attack vector behind multiple high-profile CI system compromises. pull_request_target runs with write permissions against the base repo, even for PRs from untrusted forks. When you add actions/checkout, you’re running the attacker’s code with write access to your repository.
• No permissions block (High): Without an explicit permissions: block, some trigger types (like schedule: and pull_request_target) default to write permissions on all scopes. Always declare what you need — permissions: contents: read covers most workflows.
• Secrets in run: steps (High): GitHub masks ${{ secrets.X }} when printed alone, but interpolating it into a curl URL or concatenated string bypasses masking. Always pass secrets as environment variables and reference $ENV_VAR in the shell, not ${{ secrets.X }} directly.
• persist-credentials: true (Medium): The default. Checkout writes the GITHUB_TOKEN to git config. If any subsequent step runs user-supplied code (common in CI), it can use that token to push to your repo. Disable it unless you specifically need git operations post-checkout.

For checking if your action versions are up-to-date, use the GitHub Actions Version Auditor. For Kubernetes and Docker security, see the K8s YAML Security Linter and Docker Compose Security Checker.