Workflow Sentry
Add SARIF source annotations and stable fingerprints, dated review exceptions, baseline comparisons and reusable/composite workflow coverage.
The problem it solves
Workflow Sentry Workflow Sentry audits GitHub Actions YAML locally for high-impact security risks before a workflow is merged.
Who Workflow Sentry is for
- Developers and maintainers who need reviewable evidence before changing or releasing software.
- Users working with GitHub Actions, security, static analysis who want the documented v1.1.0 behavior.
- People who prefer an open-source release with visible limitations, source, and license terms.
Intended result
Add SARIF source annotations and stable fingerprints, dated review exceptions, baseline comparisons and reusable/composite workflow coverage.
This summary is reconciled from the current catalog and repository documentation.
Features in v1.1.0
Capabilities below come from the current project README and release documentation.
Workflow Sentry audits GitHub Actions YAML locally for high-impact security risks before a workflow is merged.
It checks explicit token permissions, immutable action references, pullrequesttarget, self-hosted runners, inherited reusable-workflow secrets, checkout credential persistence, and direct shell interpolation of untrusted event text. Required security-events: write access is surfaced as informational evidence rather than treated as a defect. Reports contain rule locations and classifications, not repository secrets or workflow values.
Verified examples
Screenshots are shown only when the current README references a local source image. Otherwise, repository example files are linked directly.
Verified release evidence
This project does not currently publish a screenshot or dedicated example folder. The current README, tests, changelog, tagged release, and source repository remain the verified examples of its behavior.
Platforms and implementation
The public release claims only the cataloged platforms and technologies.
Supported platforms
- Windows
- macOS
- Linux
Built with
- Python
- PyYAML
What changed in v1.1.0
Add SARIF source annotations and stable fingerprints, dated review exceptions, baseline comparisons and reusable/composite workflow coverage.
workflow-sentry .github/workflows --format sarif --output workflow-review.sarif--format sarif emits SARIF 2.1.0 locations with one-based YAML node line/column regions and logical locations. Missing properties point to their parent node and are labeled regionExact=false. Fingerprints combine relative source path, rule and logical location, remaining stable when unrelated lines move; changing indexed steps can change fingerprints. --baseline accepts a prior JSON report. --exceptions accepts a JSON array of fingerprint, explanation and expires (ISO date); --as-of controls expiry comparison, defaulting to the current UTC date. Expired exceptions never suppress failure thresholds. Reports retain suppressed findings and distinguish new, unchanged and resolved fingerprints. Composite steps and unpinned reusable workflow calls are covered by fixtures. No workflow is run, changed, or automatically trusted.
Quick start
The shortest documented path into the current release.
python -m pip install .
workflow-sentry .github/workflows --format markdown --output workflow-security.md
workflow-sentry .github/workflows --format json --fail-on highExit status is 1 when a finding meets --fail-on. The default threshold is critical.
Current limitations
These boundaries are part of the product and prevent the page from implying unverified capability.
- Static analysis cannot prove a workflow safe or determine whether referenced third-party code is trustworthy.
- Full commit-SHA pinning is treated as immutable; local and
docker://actions are handled separately. - Expression checks are deliberately narrow and evidence-based, so novel injection patterns may require manual review.
- No network request, GitHub token, repository mutation, telemetry, or workflow execution occurs.
Supported on Python 3.10+ for Windows, macOS, and Linux. Current release: v1.1.0.
Privacy and licensing
Review the actual data boundary before using a tool with sensitive inputs.
Privacy and safety
No privacy behavior beyond the current repository documentation is claimed. Review the source, security policy, and input/output behavior before using sensitive material.
License and release
Workflow Sentry is published under MIT. The current cataloged release is v1.1.0, published 2026-09-07.
Related projects
Related projects are selected deterministically from shared catalog tags, category, and implementation technologies—not popularity or paid placement.
Workflow Sentry v1.1.0
Use the tagged release for downloads and release notes. Use the repository for source, issues, contribution guidance, security reporting, and complete documentation.
Page source: current Forge catalog plus README and CHANGELOG from the canonical local repository. Fingerprint: 18e37282e626bb35.