Check ID: githubactions_workflow_security_scan
Provider: GitHub
Service: githubactions
Severity: HIGH
Categories: software-supply-chain
Resource type: GitHubActionsWorkflow

​
What this check verifies

Scan GitHub Actions workflow files for security issues such as template injection, excessive permissions, unpinned actions, and other misconfigurations using the zizmor static analysis tool.

​
Risk

Insecure GitHub Actions workflows can lead to supply chain attacks, credential theft, code injection, and unauthorized access to repository secrets.

​
Recommendation

Review your GitHub Actions workflows for security best practices including pinning actions to commit SHAs, using minimal permissions, avoiding template injection, and securing workflow triggers.

​
Remediation

Dashboard steps Review and fix the security issues identified by zizmor in your GitHub Actions workflow files.

​
References

​
Where this check fires

This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable by Check ID = githubactions_workflow_security_scan. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks