github actions workflow audit derived

{
  "input": {
    "body": {
      "contract": {
        "require_timeout": true,
        "require_concurrency": true,
        "require_pinned_actions": true,
        "require_explicit_permissions": true
      },
      "workflow": "name: ci\non:\n  pull_request_target:\n    branches: [main]\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.pull_request.head.sha }}\n      - uses: some-vendor/deploy-action@v1\n      - name: publish\n        run: npm publish --token ${{ secrets.NPM_TOKEN }}\n      - name: label\n        run: echo \"${{ github.event.pull_request.title }}\"\n"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "jobs": [
        {
          "job": "build",
          "step_count": 4,
          "declares_timeout": false,
          "declares_permissions": false
        }
      ],
      "limits": {
        "maxFindings": 500,
        "maxYamlBytes": 262144,
        "maxDockerfileBytes": 131072,
        "maxDockerfileLines": 4000
      },
      "passed": false,
      "checked": {
        "timeout": true,
        "concurrency": true,
        "pinned_actions": true,
        "trusted_owners": [
          "actions",
          "github"
        ],
        "explicit_permissions": true
      },
      "complete": false,
      "findings": [
        {
          "code": "KEY_IS_A_YAML_BOOLEAN",
          "line": 2,
          "detail": "workflow: The key on is an unquoted YAML 1.1 boolean, so some readers parse it as false rather than as the text on.",
          "location": "(root)"
        },
        {
          "code": "PERMISSIONS_NOT_DECLARED",
          "detail": "No permissions block is declared, so the token scope is whatever the repository or organisation default is. That default is set elsewhere and can change without this file changing.",
          "location": "permissions"
        },
        {
          "code": "CONCURRENCY_NOT_DECLARED",
          "detail": "No concurrency group is declared, so two pushes in quick succession run concurrently and can race on a shared deploy target.",
          "location": "concurrency"
        }
      ],
      "job_count": 1,
      "conformant": false,
      "request_id": "example-request",
      "service_id": "github_actions_workflow_audit",
      "assumptions": [
        "The trigger key is accepted written either way, because an unquoted on is a YAML 1.1 boolean and some readers deliver the key true. When that substitution happens it is reported rather than silently h...",
        "An action pinned to anything other than a forty-character commit is reported as unpinned, and an action from a trusted owner is reported under its own code so a caller can treat the two differently.",
        "Findings about secrets never include a secret value: only the expression that references one."
      ],
      "limitations": [
        "Observable facts about the workflow file supplied. Repository and organisation settings, environment protection rules and what an action actually does are outside this. Not a security assessment.",
        "conformant is true only when the file parsed and every check that ran found nothing."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [
        "PRIVILEGED_TRIGGER_PRESENT: The workflow runs on pull_request_target, which runs with the base repository's secrets. Whether that is appropriate is the caller's decision and was not judged."
      ],
      "finding_count": 9,
      "trigger_events": [
        "pull_request_target"
      ],
      "service_version": "1.0.0",
      "findings_by_code": {
        "ACTION_PINNED_BY_TAG": 1,
        "TIMEOUT_NOT_DECLARED": 1,
        "KEY_IS_A_YAML_BOOLEAN": 1,
        "CONCURRENCY_NOT_DECLARED": 1,
        "PERMISSIONS_NOT_DECLARED": 1,
        "SECRET_INTERPOLATED_INTO_RUN": 1,
        "TRUSTED_ACTION_PINNED_BY_TAG": 1,
        "EVENT_DATA_INTERPOLATED_INTO_RUN": 1,
        "PRIVILEGED_TRIGGER_CHECKS_OUT_UNTRUSTED_REF": 1
      },
      "declares_workflow_permissions": false
    }
  }
}