rogerchappel/actionloom

actionloom

actionloom is a local-first GitHub Actions workflow generator and auditor for small OSS repositories. It reads workflow files from your checkout, points out risky permissions and CI footguns, and can loom a practical Node.js CI workflow template without calling any external service.

The project is original work inspired by the workflow-helper niche noted in the product docs, including attribution to hip-actions as adjacent inspiration. It does not copy that project name or implementation.

What it does

• Audits .github/workflows/.yml and .yaml files.
• Flags high-risk patterns such as permissions: write-all, pullrequesttarget, and curl | bash.
• Checks for intentional matrix fail-fast and Node dependency cache configuration.
• Emits Markdown or JSON reports that are easy to paste into PRs.
• Generates a conservative Node CI template with read-only default permissions.

The pullrequesttarget rule recognizes GitHub Actions mapping syntax, inline event lists, and block event lists. It reports the trigger line once per workflow while ignoring comments and unrelated scalar text.

Workflow inspection recognizes plain, single-quoted, and double-quoted mapping keys. Top-level permissions may use either a block mapping or a flow mapping such as {contents: read}; findings from a flow mapping point to its containing line.

When given a workflow file directly, inspect requires a .yml or .yaml extension. Every discovered workflow is parsed as YAML before auditing; unsupported direct files and malformed YAML exit nonzero with a diagnostic naming the file and parse problem instead of producing a partial audit report.

Install

actionloom is currently distributed as an npm-format tarball attached to each GitHub release. It is not published to the npm registry.

Install version 0.1.0 in a project directly from the release asset:

npm install https://github.com/rogerchappel/actionloom/releases/download/v0.1.0/actionloom-0.1.0.tgz

For local development:

git clone https://github.com/rogerchappel/actionloom.git
cd actionloom
npm install
npm run build
node dist/cli.js --help

For global CLI usage:

npm install -g https://github.com/rogerchappel/actionloom/releases/download/v0.1.0/actionloom-0.1.0.tgz
actionloom inspect .

Quickstart

Audit a repository and print a PR-ready Markdown report: