Actions Workflow Audit

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
    "amount": "200000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 60
  }
]

Extensions

{
  "bazaar": {
    "info": {
      "input": {
        "body": {
          "contract": {
            "require_timeout": true,
            "require_concurrency": true,
            "require_pinned_actions": true,
            "require_explicit_permissions": true
          },
          "workflow": "name: ci\non:\n  pull_request_target:\n    branches: [main]\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.pull_request.head.sha }}\n      - uses: some-vendor/deploy-action@v1\n      - name: publish\n        run: npm publish --token ${{ secrets.NPM_TOKEN }}\n      - name: label\n        run: echo \"${{ github.event.pull_request.title }}\"\n"
        },
        "type": "http",
        "method": "POST",
        "bodyType": "json"
      },
      "output": {
        "type": "json",
        "example": {
          "jobs": [
            {
              "job": "build",
              "step_count": 4,
              "declares_timeout": false,
              "declares_permissions": false
            }
          ],
          "limits": {
            "maxFindings": 500,
            "maxYamlBytes": 262144,
            "maxDockerfileBytes": 131072,
            "maxDockerfileLines": 4000
          },
          "passed": false,
          "checked": {
            "timeout": true,
            "concurrency": true,
            "pinned_actions": true,
            "trusted_owners": [
              "actions",
              "github"
            ],
            "explicit_permissions": true
          },
          "complete": false,
          "findings": [
            {
              "code": "KEY_IS_A_YAML_BOOLEAN",
              "line": 2,
              "detail": "workflow: The key on is an unquoted YAML 1.1 boolean, so some readers parse it as false rather than as the text on.",
              "location": "(root)"
            },
            {
              "code": "PERMISSIONS_NOT_DECLARED",
              "detail": "No permissions block is declared, so the token scope is whatever the repository or organisation default is. That default is set elsewhere and can change without this file changing.",
              "location": "permissions"
            },
            {
              "code": "CONCURRENCY_NOT_DECLARED",
              "detail": "No concurrency group is declared, so two pushes in quick succession run concurrently and can race on a shared deploy target.",
              "location": "concurrency"
            }
          ],
          "job_count": 1,
          "conformant": false,
          "request_id": "example-request",
          "service_id": "github_actions_workflow_audit",
          "assumptions": [
            "The trigger key is accepted written either way, because an unquoted on is a YAML 1.1 boolean and some readers deliver the key true. When that substitution happens it is reported rather than silently h...",
            "An action pinned to anything other than a forty-character commit is reported as unpinned, and an action from a trusted owner is reported under its own code so a caller can treat the two differently.",
            "Findings about secrets never include a secret value: only the expression that references one."
          ],
          "limitations": [
            "Observable facts about the workflow file supplied. Repository and organisation settings, environment protection rules and what an action actually does are outside this. Not a security assessment.",
            "conformant is true only when the file parsed and every check that ran found nothing."
          ],
          "observed_at": "2026-10-02T00:00:00.000Z",
          "not_examined": [
            "PRIVILEGED_TRIGGER_PRESENT: The workflow runs on pull_request_target, which runs with the base repository's secrets. Whether that is appropriate is the caller's decision and was not judged."
          ],
          "finding_count": 9,
          "trigger_events": [
            "pull_request_target"
          ],
          "service_version": "1.0.0",
          "findings_by_code": {
            "ACTION_PINNED_BY_TAG": 1,
            "TIMEOUT_NOT_DECLARED": 1,
            "KEY_IS_A_YAML_BOOLEAN": 1,
            "CONCURRENCY_NOT_DECLARED": 1,
            "PERMISSIONS_NOT_DECLARED": 1,
            "SECRET_INTERPOLATED_INTO_RUN": 1,
            "TRUSTED_ACTION_PINNED_BY_TAG": 1,
            "EVENT_DATA_INTERPOLATED_INTO_RUN": 1,
            "PRIVILEGED_TRIGGER_CHECKS_OUT_UNTRUSTED_REF": 1
          },
          "declares_workflow_permissions": false
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method",
            "bodyType",
            "body"
          ],
          "properties": {
            "body": {
              "type": "object",
              "required": [
                "workflow"
              ],
              "properties": {
                "contract": {
                  "type": "object",
                  "properties": {
                    "require_timeout": {
                      "type": "boolean"
                    },
                    "require_concurrency": {
                      "type": "boolean"
                    },
                    "trusted_action_owners": {
                      "type": "array",
                      "items": {
                        "type": "string",
                        "maxLength": 64
                      },
                      "maxItems": 50,
                      "minItems": 1
                    },
                    "require_pinned_actions": {
                      "type": "boolean"
                    },
                    "require_explicit_permissions": {
                      "type": "boolean"
                    }
                  },
                  "additionalProperties": false
                },
                "workflow": {
                  "type": "string",
                  "maxLength": 262144
                }
              },
              "additionalProperties": false
            },
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "POST"
              ],
              "type": "string"
            },
            "bodyType": {
              "enum": [
                "json",
                "form-data",
                "text"
              ],
              "type": "string"
            }
          },
          "additionalProperties": false
        },
        "output": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string"
            },
            "example": {
              "type": "object"
            }
          }
        }
      }
    }
  }
}

Provenance

Seen in the source catalog

2026-10-04 08:24Z

Last indexed by Roundhouse

2026-10-05 00:20Z

Last enriched (probe, favicon, geo)

2026-10-05 02:45Z

x402 version

2

Max timeout

60s

Liveness probe

HTTP 0