5 GitHub Actions YAML checks before you trust a CI run

Description and use

<p>A green GitHub Actions badge tells you the workflow completed. It does not prove that the workflow's token permissions, event triggers, dependencies, or execution environment are safe.</p> <p>I built a small, <strong>free, browser-only</strong> pattern checker for a few of these risks. In building and testing it, I found five questions worth asking during every CI configuration review.</p> <p>All YAML below is <strong>synthetic</strong>. I'm not claiming a vulnerability in a real third-party repository.</p> <h2> 1. What can <code>GITHUB_TOKEN</code> actually write? </h2> <p>Start with the s

Problem

<p>A green GitHub Actions badge tells you the workflow completed. It does not prove that the workflow's token permissions, event triggers, dependencies, or execution environment are safe.</p> <p>I built a small, <strong>free, browser-only</strong> pattern checker for a few of these risks. In building and testing it, I found five questions worth asking during every CI configuration review.</p> <p>All YAML below is <strong>synthetic</strong>. I'm not claiming a vulnerability in a real third-party repository.</p> <h2> 1. What can <code>GITHUB_TOKEN</code> actually write? </h2> <p>Start with the s

Outcome

<p>A green GitHub Actions badge tells you the workflow completed. It does not prove that the workflow's token permissions, event triggers, dependencies, or execution environment are safe.</p> <p>I built a small, <strong>free, browser-only</strong> pattern checker for a few of these risks. In building and testing it, I found five questions worth asking during every CI configuration review.</p> <p>All YAML below is <strong>synthetic</strong>. I'm not claiming a vulnerability in a real third-party repository.</p> <h2> 1. What can <code>GITHUB_TOKEN</code> actually write? </h2> <p>Start with the s

Evidence

5 GitHub Actions YAML checks before you trust a CI run

Source