I built a scanner for CI checks that can't fail

Description and use

Muraqib scanner identifies hidden failure modes in GitHub Actions CI workflows, enabling fixes and ensuring reliable failure reporting.

Problem

CI workflows often contain steps that silently succeed even when critical errors occur, masking real problems and preventing timely alerts.

Outcome

The scanner detects hidden failure modes in CI workflows, enabling teams to correct them and ensure that CI truly reports failures, improving reliability and security.

Workflow

• Clone the repository
• Run npx muraqib doctor against the repo
• Review the output for any of the four failure patterns
• Fix any identified issues (remove continue-on-error, add secret checks, adjust timeout settings)
• Re-run the CI to confirm the changes
• Commit and push the updated workflow files

Evidence

74% had at least one step that cannot fail no matter what it finds.

Source

Muraqib runs npx muraqib doctor against a repo's CI setup and looks for exactly that failure mode

Source