GitHub Actions permissions
Make repository tokens boring before a release workflow can do too much.
GHA Guard Pro Kit is a paid Node source kit for reviewing GitHub Actions permissions locally: broad grants, missing least-privilege defaults, checkout credential persistence, and PR-ready markdown reports.
Permission Risks Covered
Flags workflows with no top-level permissions block so inherited token scope is visible during review.
Highlights write-all and broad write permissions on jobs that should usually start from read-only access.
Checks for checkout credential persistence so later steps do not keep repository write credentials by accident.
What buyers get
| Need | Included source | Result |
|---|---|---|
| Audit existing workflows | Local CLI checks with text, JSON, and markdown report output. | Reviewers can paste a focused workflow hardening report into PRs. |
| Fix safe defaults | Conservative auto-fixes for mechanical permission and timeout defaults. | Teams get quicker cleanup without risky semantic rewrites. |
| Teach a safer pattern | Hardened workflow examples, a composite action template, remediation notes, and buyer smoke tests. | Future release YAML starts from a better baseline. |
Buyer Verification
The paid zip includes runnable checks: npm run verify:manifest,
npm test, and npm run smoke:buyer. The live Gumroad
checkout currently sells the attached GHA Guard Pro Kit package.