Find forbidden action usage
Recipe ID
org.openrewrite.github.security.ForbiddenUsesArtifact
org.openrewrite.recipe:rewrite-github-actionsFind usage of forbidden or dangerous GitHub Actions that have known security vulnerabilities or follow suspicious patterns. Based on zizmor's forbidden-uses audit.
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe org.openrewrite.github.security.ForbiddenUsesIf the recipe isn’t available locally, install it with:
mod config recipes jar install org.openrewrite.recipe:rewrite-github-actions:3.28.0Options
| Name | Type | Description |
|---|---|---|
additionalDangerousActions | List | Additional actions to flag as dangerous, beyond the built-in list. These will be merged with the default dangerous actions. e.g. ["some-org/dangerous-action@v1", "another-org/risky-action@v2"] |
additionalSuspiciousPatterns | List | Additional patterns to flag as suspicious, beyond the built-in patterns. These will be merged with the default suspicious patterns. e.g. ["malware", "crypto-miner", "backdoor"] |
Data tables
Structured output this recipe can produce.
- Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats