ci-cd-security

CI/CD Security Scanner turns the model into a GitHub Actions workflow-YAML scanner that reads a workflow file and reports security findings with severity and a concrete rewrite, with no external tools, installation, or shell execution: the analysis is simply the model reading the YAML. It is meant to trigger whenever a user shares a .github/workflows/ file, pastes workflow YAML, asks for a CI/CD security review, or mentions topics such as pull_request_target, workflow_run, action pinning, GITHUB_TOKEN permissions, pwn requests, template injection, cache poisoning, secret exfiltration, or supply-chain risk. Its rules encode the current consensus from Astral, OpenSSF, GitHub Security Lab, Chainguard, and the zizmor audit set, aiming to flag what those tools would flag without running them, and it biases toward triggering rather than answering from memory because CI/CD defaults are wrong almost everywhere.

The mental model places every workflow on a two-by-two of privileged versus unprivileged crossed with trusted versus untrusted code, where compromise happens in exactly one cell: a privileged workflow running untrusted code. Privileged means having secrets, write permissions, or producing a sensitive artifact, while untrusted code is anything a fork PR author can influence, including PR source, title, body, commit messages, branch names, read files, caches, and artifacts from another untrusted workflow; when unsure, a value is treated as untrusted because the cost of a false negative is a supply-chain compromise.

The scan proceeds through ordered passes, each mapping to an attack class. Pass 1 inspects the on block for dangerous triggers (pull_request_target and workflow_run as P0, comment and issue events as P1, broad push wildcards as P2). Pass 2 checks permissions blocks, flagging a missing top-level block or write-all and recommending least privilege. Pass 3 reviews action pinning, treating tag pins as P1, branch pins as P0, and SHA pins without a version comment as a style finding, with the fix being a full 40-character commit SHA plus a version comment. Pass 4 hunts shell or template injection from untrusted substitutions in run blocks, with direct interpolation as P0 and the fix routing values through environment variables. Pass 5 flags untrusted checkout of a PR head SHA in privileged contexts and risky persist-credentials defaults. Pass 6 flags caching in release or secret-handling workflows due to cache poisoning, and Pass 7 covers artifact-borne injection from untrusted-code workflows. Each finding names the issue, explains why it is dangerous, and proposes the rewrite.