Workflow Sentry
Audit GitHub Actions workflows locally for permission, immutable-reference, injection, runner, credential, and secret risks.
The problem it solves
Workflow Sentry Workflow Sentry audits GitHub Actions YAML locally for high-impact security risks before a workflow is merged.
Who Workflow Sentry is for
- Developers and maintainers who need reviewable evidence before changing or releasing software.
- Users working with GitHub Actions, security, static analysis who want the documented v1.0.0 behavior.
- People who prefer an open-source release with visible limitations, source, and license terms.
Intended result
Audit GitHub Actions workflows locally for permission, immutable-reference, injection, runner, credential, and secret risks.
This summary is reconciled from the current catalog and repository documentation.
Features in v1.0.0
Capabilities below come from the current project README and release documentation.
Workflow Sentry audits GitHub Actions YAML locally for high-impact security risks before a workflow is merged.
It checks explicit token permissions, immutable action references, pullrequesttarget, self-hosted runners, inherited reusable-workflow secrets, checkout credential persistence, and direct shell interpolation of untrusted event text. Required security-events: write access is surfaced as informational evidence rather than treated as a defect. Reports contain rule locations and classifications, not repository secrets or workflow values.
Verified examples
Screenshots are shown only when the current README references a local source image. Otherwise, repository example files are linked directly.
Verified release evidence
This project does not currently publish a screenshot or dedicated example folder. The current README, tests, changelog, tagged release, and source repository remain the verified examples of its behavior.
Platforms and implementation
The public release claims only the cataloged platforms and technologies.
Supported platforms
- Windows
- macOS
- Linux
Built with
- Python
- PyYAML
Quick start
The shortest documented path into the current release.
python -m pip install .
workflow-sentry .github/workflows --format markdown --output workflow-security.md
workflow-sentry .github/workflows --format json --fail-on highExit status is 1 when a finding meets --fail-on. The default threshold is critical.
Current limitations
These boundaries are part of the product and prevent the page from implying unverified capability.
- Static analysis cannot prove a workflow safe or determine whether referenced third-party code is trustworthy.
- Full commit-SHA pinning is treated as immutable; local and
docker://actions are handled separately. - Expression checks are deliberately narrow and evidence-based, so novel injection patterns may require manual review.
- No network request, GitHub token, repository mutation, telemetry, or workflow execution occurs.
Supported on Python 3.10+ for Windows, macOS, and Linux. Current release: v1.0.0.
Privacy and licensing
Review the actual data boundary before using a tool with sensitive inputs.
Privacy and safety
No privacy behavior beyond the current repository documentation is claimed. Review the source, security policy, and input/output behavior before using sensitive material.
License and release
Workflow Sentry is published under MIT. The current cataloged release is v1.0.0, published 2026-08-10.
Related projects
Related projects are selected deterministically from shared catalog tags, category, and implementation technologies—not popularity or paid placement.
Workflow Sentry v1.0.0
Use the tagged release for downloads and release notes. Use the repository for source, issues, contribution guidance, security reporting, and complete documentation.
Page source: current Forge catalog plus README and CHANGELOG from the canonical local repository. Fingerprint: 59e259a06cb07ed5.