Awesome Reviewers

Verification · Static analysis

CI workflow linting

Checks CI definitions themselves: syntax, script injection through untrusted inputs, over-broad token permissions, unpinned actions.

Sub-techniques

  • Workflow syntax V1009.001

    Validate workflow files and embedded shell before they run.

  • Workflow security audit V1009.002

    Flag template injection, pull_request_target misuse, unpinned third-party actions and write-all permissions.

How to build it

  1. Run actionlint on every change to .github/workflows.
  2. Add zizmor and fix its high findings first: injection and permissions.
  3. Pin third-party actions to commit SHAs.

Signals in a repository

  • actionlint or zizmor in CI or pre-commit.
  • permissions: blocks at workflow level and SHA-pinned uses: lines.