suzuki-shunsuke/ghalint

ghalint

Install | Policies | How to use | Configuration

GitHub Actions linter for security best practices.

$ ghalint run
ERRO[0000] read a workflow file                          error="parse a workflow file as YAML: yaml: line 10: could not find expected ':'" program=ghalint version= workflow_file_path=.github/workflows/release.yaml
ERRO[0000] github.token should not be set to workflow's env  env_name=GITHUB_TOKEN policy_name=workflow_secrets program=ghalint version= workflow_file_path=.github/workflows/test.yaml
ERRO[0000] secret should not be set to workflow's env    env_name=DATADOG_API_KEY policy_name=workflow_secrets program=ghalint version= workflow_file_path=.github/workflows/test.yaml

ghalint is a command line tool to check GitHub Actions Workflows and action.yaml for security policy compliance.

:bulb: We've ported ghalint to lintnet module

• https://lintnet.github.io/
• https://github.com/lintnet-modules/ghalint

lintnet is a general purpose linter powered by Jsonnet. We've ported ghalint to the lintnet module, so you can migrate ghalint to lintnet!

Policies

1. Workflow Policies

• jobpermissions: All jobs should have permissions
• denyreadallpermission: read-all permission should not be used
• denywriteallpermission: write-all permission should not be used
• denyinheritsecrets: secrets: inherit should not be used
• workflowsecrets: Workflow should not set secrets to environment variables
• jobsecrets: Job should not set secrets to environment variables

• denyjobcontainerlatestimage: Job's container image tag should not be latest
• actionrefshouldbefulllengthcommitsha: action's ref should be full length commit SHA
• githubappshouldlimitrepositories: GitHub Actions issuing GitHub Access tokens from GitHub Apps should limit repositories
• githubappshouldlimitpermissions: GitHub Actions issuing GitHub Access tokens from GitHub Apps should limit permissions
• jobtimeoutminutesisrequired: All jobs should set timeout-minutes
• checkoutpersistcredentialsshouldbefalse: actions/checkout's input persist-credentials should be false

2. Action Policies

• actionrefshouldbefulllengthcommitsha: action's ref should be full length commit SHA
• githubappshouldlimitrepositories: GitHub Actions issuing GitHub Access tokens from GitHub Apps should limit repositories
• githubappshouldlimitpermissions: GitHub Actions issuing GitHub Access tokens from GitHub Apps should limit permissions
• actionshellisrequired: shell is required if run is set
• checkoutpersistcredentialsshouldbefalse: actions/checkout's input persist-credentials should be false

How to use

1. Validate workflows

Run the command ghalint run on the repository root directory.

ghalint run