GitHub
Releases
Security & compliance
Stability
Actions supply chain
Your CI runs third-party code with your secrets attached.
Overview
lumioguard reads every workflow in .github/workflows and reports where untrusted input reaches a run step, where an action is pinned to something mutable, and where a job holds more token scope than it uses.
What it looks for
- Third-party actions pinned to a tag or branch instead of a commit SHA
- pull_request_target combined with a PR-head checkout
- github.event values interpolated straight into a run step
- Workflows with no permissions block, defaulting to broad token scope
- Secrets echoed into step output, and pipelines failing repeatedly
Why it matters
An action pinned to a tag is an action whose author can change what runs tomorrow, inside a job holding your registry tokens. A pull_request_target workflow that checks out the PR head runs a stranger’s code with write access to your repository.
Rules in this check
| What it reports | Fix path |
|---|---|
| Third-party action pinned to mutable tag | Guide |
| Pull_request_target with PR-head checkout (pwn-request) | Guide |
| Secret value echoed in run step | Pull request |
| Workflow missing permissions block | Pull request |
| Script injection via github.event expression in run step | Guide |
| CI pipeline failing repeatedly | Guide |
| A specific workflow failing repeatedly | Guide |
How the fixes arrive
Pull requestLow-risk changes arrive as a pull request on a lumioguard branch, with a breakage analysis attached. You review and merge it.
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.