githubActions.configs.security

Security-focused checks for workflow permissions and immutable action references in workflows and composite actions.

This preset targets workflow YAML and action.yml / action.yaml metadata. In composite actions, pin-action-shas checks external runs.steps[*].uses references.

Included rules

Fix legend:

• 🔧 = autofixable
• 💡 = suggestions available
• — = report only

Rule	Fix
R026 no-inherit-secrets	—
R030 no-pr-head-checkout-in-pull-request-target	—
R027 no-secrets-in-if	—
R036 no-self-hosted-runner-on-fork-pr-events	—
R029 no-untrusted-input-in-run	—
R023 no-write-all-permissions	—
R003 pin-action-shas	—
R098 require-codeql-security-events-write	—
R111 require-dependabot-automation-permissions	—
R112 require-dependabot-automation-pull-request-trigger	—
R109 require-dependabot-bot-actor-guard	—
R091 require-dependency-review-action	—
R093 require-dependency-review-fail-on-severity	—
R092 require-dependency-review-permissions-contents-read	—
R094 require-dependency-review-pull-request-trigger	—
R110 require-fetch-metadata-github-token	—
R032 require-pull-request-target-branches	—
R102 require-sarif-upload-security-events-write	—
R107 require-secret-scan-contents-read	—
R105 require-secret-scan-fetch-depth-zero	—
R106 require-secret-scan-schedule	—
R108 require-trufflehog-verified-results-mode	—
R001 require-workflow-permissions	—
R028 require-workflow-run-branches	—