I spent a day auditing GitHub Actions across a dozen AI agent frameworks

说明与用途

对十个 AI 代理框架的 CI 工作流进行审计，发现配置错误并提交 PR 进行修复。

问题

CI workflows in popular AI agent projects often contain misconfigurations, unpinned actions, and silent regressions that go unnoticed, compromising reliability and security.

结果

Half of the examined repositories had at least one workflow issue; PRs were opened for remediation, raising awareness of CI hygiene in the AI community.

工作流

• 1. Enumerate target repositories
• 2. Clone each repo and inspect .github/workflows
• 3. Check for unpinned actions and mutable tags
• 4. Verify exit codes and failure handling
• 5. Identify silent reverts of security guards
• 6. Document findings and create PRs
• 7. Notify maintainers and track review status

证据

Microsoft's autogen had a CI check meant to catch out of sync generated proto files. It could never fail.

来源

griptape had an action pinned to a mutable tag instead of a commit hash, tj-actions/changed-files at v47.

来源