GitHub Actions Workflow Security & Reliability Auditor

Built a Python CLI that statically reviews GitHub Actions workflows for common security and reliability risks and produces human-readable or JSON results for automation.

Workflow problems are often discovered after a security review, failed deployment, or production incident. Teams need a fast way to identify common configuration risks before execution without requiring access to proprietary repositories or production systems.

I designed a dependency-light Python analyzer that parses workflow YAML and applies focused checks for permissions, action references, shell input, privileged pull-request patterns, OIDC use, secret inheritance, concurrency, and timeouts.

10 workflow security and reliability rules

Text and JSON output

Configurable failure thresholds

Secure and insecure synthetic examples

11 automated tests

Hardened CI workflow

Installation, usage, and security documentation

The project demonstrates how repeatable static checks can turn workflow-review knowledge into an automation-friendly tool. It gives teams a consistent first pass while preserving human review for context and risk decisions.

The project uses only public documentation and synthetic workflow examples. It contains no employer source code, customer data, internal cases, or private documentation. This is an independent project and does not imply official GitHub endorsement.