GitHub Actions Security Checker

Check workflow YAML before it deploys risky code.

Paste a GitHub Actions workflow. Deploylint checks token permissions, pull_request_target usage, floating third-party action refs, and whether CI actually runs lint, typecheck, tests, and build.

Automated heuristic check. It does not execute workflows, inspect repository settings, or prove a workflow is secure.

Workflow YAML

Checks up to 80,000 characters. Large repos should use the repo scan or CI gate.

Hardening score

/100

Risky

0 pass 4 warn 1 fail

Fix the failed security finding before production deploys; use advisory mode first when you add Deploylint to CI.

Agent repair prompt

Fix this GitHub Actions workflow before it is used for production deploys.
Preserve existing behavior, but make these hardening changes:
- CI quality gates: Run lint, typecheck, tests, and build before any deploy step.
- Workflow permissions: Declare least-privilege permissions at workflow or job scope.
- pull_request_target safety: Avoid running untrusted PR code or shell interpolation inside pull_request_target workflows.
- Workflow action pinning: Pin third-party actions to a release tag or commit SHA.
- Dependency review action: Run GitHub dependency review on pull requests before merge.
Return the complete corrected workflow YAML and briefly explain each security-relevant change.

Least-privilege starter workflow

Paste this as .github/workflows/ci.yml, then require it before deploy jobs run.

name: CI hardening gate

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read
  pull-requests: read

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run lint
      - run: npm run check
      - run: npm test
      - run: npm run build

  dependency-review:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/dependency-review-action@v4

Next: advisory CI report

Add this after the workflow is clean. It writes an Actions job summary and does not block builds. Set the DEPLOYLINT_URL secret to your staging or production URL.

This zero-install workflow runs Deploylint's hosted script in CI. Vendor the script or composite action if your supply-chain policy requires reviewed, pinned code.

name: Deploylint advisory report

on:
  pull_request:
  workflow_dispatch:

permissions: {}

jobs:
  deploylint:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Run Deploylint advisory scan
        env:
          DEPLOYLINT_URL: ${{ secrets.DEPLOYLINT_URL }}
          DEPLOYLINT_API: https://deploylint.com
          DEPLOYLINT_MODE: advisory
          DEPLOYLINT_MIN_SCORE: '80'
        run: |
          curl -fsSL https://deploylint.com/gate-remote.mjs -o gate-remote.mjs
          node gate-remote.mjs "$DEPLOYLINT_URL"

Findings

Quality gates

warn

GitHub Actions workflow is missing quality gates: lint, typecheck, build.

Run lint, typecheck, tests, and build before any deploy step.

- run: npm ci
- run: npm run lint
- run: npm run check
- run: npm test
- run: npm run build

Token permissions

warn

GitHub Actions workflow grants permissions: write-all.

Declare least-privilege permissions at workflow or job scope.

permissions:
  contents: read

pull_request_target safety

fail

pull_request_target workflow runs shell code with untrusted pull request context.

Avoid running untrusted PR code or shell interpolation inside pull_request_target workflows.

on: pull_request
permissions:
  contents: read

Action pinning

warn

Third-party GitHub Action uses a floating ref such as main, master, or latest.

Pin third-party actions to a release tag or commit SHA.

- uses: vendor/action@v1

Dependency review

warn

No GitHub dependency review action found; vulnerable dependency changes may reach review unnoticed.

Run GitHub dependency review on pull requests before merge.

- uses: actions/dependency-review-action@v4