ghalint

README

ghalint

GitHub Actions linter for security best practices.

Blog post

Policies

• job_permissions: All jobs should have permissions
• deny_read_all_permission: read-all permission should not be used
• deny_write_all_permission: write-all permission should not be used
• deny_inherit_secrets: secrets: inherit should not be used
• workflow_secrets: Workflow should not set secrets to environment variables
• job_secrets: Job should not set secrets to environment variables
• deny_job_container_latest_image: Job's container image tag should not be latest
• action_ref_should_be_full_length_commit_sha: action's ref should be full length commit SHA

How to install

• Download a pre-built binary from GitHub Releases and locate an executable binary ghalint in PATH
• Homebrew: brew install suzuki-shunsuke/ghalint/ghalint
• aqua: aqua g -i suzuki-shunsuke/ghalint

How to use

$ ghalint run

$ ghalint run
ERRO[0000] read a workflow file                          error="parse a workflow file as YAML: yaml: line 10: could not find expected ':'" program=ghalint version= workflow_file_path=.github/workflows/release.yaml
ERRO[0000] github.token should not be set to workflow's env  env_name=GITHUB_TOKEN policy_name=workflow_secrets program=ghalint version= workflow_file_path=.github/workflows/test.yaml
ERRO[0000] secret should not be set to workflow's env    env_name=DATADOG_API_KEY policy_name=workflow_secrets program=ghalint version= workflow_file_path=.github/workflows/test.yaml

Configuration file

Configuration file path: ^\.?ghalint\.ya?ml$

You can exclude the policy job_secrets and action_ref_should_be_full_length_commit_sha.

e.g.

excludes:
  - policy_name: job_secrets
    workflow_file_path: .github/workflows/actionlint.yaml
    job_name: actionlint
  - policy_name: action_ref_should_be_full_length_commit_sha
    action_name: slsa-framework/slsa-github-generator

• policy_name: Only job_secrets and action_ref_should_be_full_length_commit_sha is supported

Environment variables

• GHALINT_LOG_COLOR: Configure log color. One of auto (default), always, and never.

💡 If you want to enable log color in GitHub Actions, please try GHALINT_LOG_COLOR=always

env:
  GHALINT_LOG_COLOR: always

AS IS

TO BE

How does it works?

ghalint reads GitHub Actions Workflows ^\.github/workflows/.*\.ya?ml$ and validates them. If there are violatation ghalint outputs error logs and fails. If there is no violation ghalint succeeds.

Why not actionlint?

We develop ghalint to support our policies that actionlint doesn't cover. We don't aim to replace actionlint to ghalint. We use both actionlint and ghalint.

LICENSE

MIT