GitHub Actions security insights

Usage

This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.

mod run . --recipe org.openrewrite.github.security.GitHubActionsSecurity

If the recipe isn’t available locally, install it with:

mod config recipes jar install org.openrewrite.recipe:rewrite-github-actions:3.28.0

Definition

This recipe runs the following recipes in order.

• Find credential persistence through GitHub Actions artifactsorg.openrewrite.github.security.ArtifactSecurity
• Find spoofable bot actor checksorg.openrewrite.github.security.BotConditions
• Find cache poisoning vulnerabilitiesorg.openrewrite.github.security.CachePoisoning
• Find dangerous workflow triggersorg.openrewrite.github.security.DangerousTriggers
• Find excessive permissionsorg.openrewrite.github.security.ExcessivePermissions
• Find forbidden action usageorg.openrewrite.github.security.ForbiddenUses
• Find dangerous GITHUB_ENV usageorg.openrewrite.github.security.GitHubEnv
• Find hardcoded container credentialsorg.openrewrite.github.security.HardcodedCredentials
• Find insecure commands configurationorg.openrewrite.github.security.InsecureCommands
• Find obfuscated GitHub Actions featuresorg.openrewrite.github.security.Obfuscation
• Find commit SHAs with potentially mismatched version commentsorg.openrewrite.github.security.RefVersionMismatch
• Find unconditional secrets inheritanceorg.openrewrite.github.security.SecretsInherit
• Find usage of self-hosted runnersorg.openrewrite.github.security.SelfHostedRunner
• Find template injection vulnerabilitiesorg.openrewrite.github.security.TemplateInjection
• Find manual credentials instead of trusted publishingorg.openrewrite.github.security.TrustedPublishing
• Document permissions usageorg.openrewrite.github.security.UndocumentedPermissions
• Pin GitHub Actions to specific commitsorg.openrewrite.github.security.UnpinnedActions
• Pin Docker images to digestsorg.openrewrite.github.security.UnpinnedDockerImages

Data tables

Structured output this recipe can produce.

• Source files that had resultsSource files that were modified by the recipe run.org.openrewrite.table.SourcesFileResults
• Source files that had search resultsSearch results that were found during the recipe run.org.openrewrite.table.SearchResults
• Source files that errored on a recipeThe details of all errors produced by a recipe run.org.openrewrite.table.SourcesFileErrors
• Recipe performanceStatistics used in analyzing the performance of recipes.org.openrewrite.table.RecipeRunStats