GitHub Actions workflow scanner
Scan workflow YAML locally before broad permissions reach your release jobs.
GHA Guard Pro Kit is a paid Node source kit for teams that want a local GitHub Actions workflow scanner they can run in a repo, CI job, or PR review checklist without sending workflow contents to a hosted service.
Scanner Coverage
Checks broad write grants, write-all, missing top-level permissions, and checkout credential persistence.
Flags risky pull_request_target usage and shell interpolation from GitHub context values.
Reports mutable action refs, missing timeouts, and broad runner labels that can make deploy workflows harder to review.
When To Buy
| Search need | What the kit gives you | What it does not claim |
|---|---|---|
| You want a GitHub Actions workflow scanner you can own and adapt. | Runnable source, tests, sample risky and hardened workflows, templates, and buyer verification commands. | It is not a managed SaaS, vulnerability feed, or formal security certification. |
| You need quick review output for maintainers. | Markdown reports suitable for PR notes plus JSON output for deeper automation. | It does not replace human review of secrets, deploy environments, or organization policy. |
| You want mechanical fixes without unsafe magic. | Safe defaults for permissions and timeouts while leaving risky semantic changes for a maintainer. | It does not silently rewrite third-party action pins or deploy logic. |
Buyer Verification
Verify delivered files with npm run verify:manifest.
Run the included unit tests with npm test.
Run npm run smoke:buyer against the delivered zip workflow.
Checkout
The live Gumroad listing sells the GHA Guard Pro Kit for $29 and currently points to the paid source package. Buy it there if you want the scanner source, templates, reports, and local verification commands.