ci-assessment

name	ci-assessment
description	READ-ONLY CI/CD pipeline security assessment for GitHub Actions, dependency security, and software supply chain
category	security-assessment
tags	["cicd","github-actions","supply-chain","dependency-security","branch-protection","secrets","pipeline-security"]
tech_stack	["github","gh-cli"]
cwe_ids	["CWE-94","CWE-78","CWE-269","CWE-311","CWE-502","CWE-829"]
chains_with	["T1195.002","T1059.004","T1552.001"]
prerequisites	["gh-cli-access"]
version	1.0

CI/CD Pipeline Security Assessment

READ-ONLY CI/CD security assessment using gh CLI and local filesystem inspection. No repositories, workflows, or configurations are modified. Focused on GitHub Actions but includes dependency and supply chain checks applicable to any CI platform.

Prerequisites

1. gh CLI installed and authenticated — gh auth status
2. Repository access — read access to target repository
3. For dependency_audit — local checkout of the repository

# Quick prerequisite check
gh auth status          # verify GitHub auth
gh repo view OWNER/REPO # verify repo access

Assessment Phases

Phase 1 — GitHub Actions Workflow Security

Check	Command	Risk
Dangerous triggers	ci_audit github_actions_audit --repo OWNER/REPO	pull_request_target, workflow_dispatch injection
Script injection	ci_audit github_actions_audit --repo OWNER/REPO	${{ github.event.* }} in run blocks
Token permissions	ci_audit github_permissions_audit --repo OWNER/REPO	Missing or overly broad GITHUB_TOKEN scope
Action pinning	ci_audit github_actions_pinning_audit --repo OWNER/REPO	Unpinned third-party actions (tag poisoning)

Phase 2 — Secrets & Runner Security

Check	Command	Risk
Secret leakage	ci_audit github_secrets_exposure_audit --repo OWNER/REPO	Secrets in logs, env dumps, artifacts
Self-hosted runners	ci_audit github_runner_audit --repo OWNER/REPO	Runner persistence, PR-triggered execution

Phase 3 — Repository Security

Check	Command	Risk
Branch protection	ci_audit github_branch_protection_audit --repo OWNER/REPO