README
¶
Proaction
Proaction is a CLI that recommends and updates GitHub Action Workflows in order to make them more reliable. Certain patterns in Workflows can result in flaky and unreliable output, or can create dependencies that break when external Actions are updated.
The goal of Proaction is to encourage creating workflows that secure, reliable, and will not change unexpectedly.
Best Practices
Proaction will recommend changes to workflows in order to follow the following best practices:
1. Reproducibility
Having reproducible workflows is important in order to ensure that each execution is both reliable and deterministic. A workflow is reproducible when multiple executions of the same workflow using the same commit is guaranteed to produce the exact same result at artifact.
2. Secure
Workflows should not use Actions with open CVEs or other security vulnerabilities.
3. Updated
Workflows should be able to easily remain updated to use the latest version of an Action. This is needed for security fixes and for performance and feature updates from the Action.
4. Maintainability
Workflows should be written to be easy to maintain, minimizing the work needed to follow the other best practices.
Getting Started
Install Proaction
To install Proaction, download the latest release from the Releases page or visit the docs for other options.
Running With A Workflow File
$ proaction scan ./path/to/.github/workflows/workflow.yaml
Running In GitHub Actions
Proaction can run as a GitHub Action. To create a workflow using Proaction, read the Action documentation.
Read More
To read more, visit the documentation. The docs list all of the Proaction checks that are performed and explain the reasons for each.
GitHub API and Rate Limits
Proaction uses the GitHub API to look up and analyze actions that a workflow references. Unauthenticated requests to the GitHub API are limited to 60 per hour from any single IP address. To increase this and allow Proaction to scan multiple workflows, create a Personal Access Token and give this token repo access.
Data / Telemetry
This project collects usage data to help improve the product. No data will be sent if the --no-track flag is provided to the CLI.
Directories