6.5k stars · MIT · v1.30.1, read from /releases/latest, shown as '09 Sep' with no year and therefore 9 September 2026 · Track this in Scout
It reads the GitHub Actions files in your project and reports the security mistakes in them, without running or changing anything.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A command-line tool written in Rust. It examines the workflow files in .github/workflows/ without running them and checks them against a growing set of known dangerous patterns: text from an untrusted source used where it becomes a command, permissions wider than the job needs, third-party actions pinned to a moving name instead of a fixed commit, and secrets available to jobs that should not see them.What it is good for. Anyone whose project runs anything automatically on GitHub, which today is almost everyone. The problem it removes is a class of mistake nobody can see by reading, and which only becomes visible when it is used. A short line about Grasppy and ScalpingMate: both are private, and the risk there is smaller, but the same files usually hold the deploy keys for the server.
- One command against files you already have, and it changes nothing.
- The explanations say why a line is dangerous, so it teaches rather than just complaining.
- MIT licence, backed by Trail of Bits, and a release most weeks: v1.30.1 on 9 September 2026.
- It only covers GitHub Actions. A project that builds elsewhere gets nothing from it.
- Some of its findings are cautious and will not apply to you. Read them rather than turning them all off.
- It reports the mistake. Fixing it is still yours, and some fixes mean changing how a job is triggered.
- rhysd/actionlint
It checks the same files for syntax and type mistakes rather than for security, so the two are a pair and not a choice.
Track this in Scout - aquasecurity/trivy
It scans containers, dependencies and configuration for known problems, which is a much wider net and not aimed at this one file type.
Track this in Scout 
mongodb/kingfisherPublished in Edition 16, it finds keys that have already leaked into your code, which is the problem after this one fails to be prevented.
Track this in Scout
```bash
