GitHub Actions / deploy workflow security

Your deploy workflow is production infrastructure. Review it before it ships.

DeployLint is a local, customer-run guard for GitHub Actions deployment workflows. Name the files. It shows the trigger, permission, reference, shell, and runner paths that deserve a review—bound to exact source evidence.

Buy the $149 pilot See the five checks ↓

No checkout · no execution · no upload · no external network

For platform and security engineers

A valid workflow can still hand untrusted input to a privileged deploy.

A deploy workflow crosses trust boundaries. An elevated trigger can process untrusted code. A pull-request value can become shell text. A mutable action ref can change later. A self-hosted runner can turn a workflow mistake into an environment problem.

DeployLint gives a small team a bounded review of those edges before a workflow change is merged. It does not pretend to assess your cloud account, repository settings, dependencies, or runtime behavior outside the files you supply.

What you are buying

Five checks. Five review decisions.

The first release is deliberately narrow. Each rule produces a stable ID, source location, evidence, disposition, and suggested next move. Missing owner context is INCONCLUSIVE, never silently clean.

TRG-001

Privileged triggers

Review elevated events connected to untrusted checkout or execution.

trigger → trust edge
PER-001

Excess permissions

Compare deploy-job permissions with the policy you explicitly supply.

permission → owner intent
REF-001

Mutable references

Find actions and reusable workflows that are not pinned to a commit.

ref → repeatability
EXE-001

Untrusted shell input

Show GitHub context interpolation that reaches an executable sink.

input → command
RUN-001

Runner trust

Detect an untrusted path reaching a self-hosted or privileged runner.

path → runner
How it fits your review

Run it against the files you already have.

There is no repository integration to configure. You explicitly admit workflow and policy files, verify their identity, and retain the report bundle in your own environment.

  1. Name the scope.Create a manifest for the deploy workflow and optional policy.
  2. Guard the bytes.Parse YAML as inert data; nothing is executed or fetched.
  3. Review the bundle.Open JSON, SARIF, HTML, or Markdown with exact manifest binding.
customer-run / offlineCPython 3.14
ROOT="$(realpath /path/to/repository)"
DEPLOYLINT=.deploylint-venv/bin/deploylint

$DEPLOYLINT manifest \
  --root "$ROOT" \
  --workflow .github/workflows/deploy.yml \
  --policy deploylint.policy.json \
  > deploylint-input.json

$DEPLOYLINT guard \
  --manifest deploylint-input.json \
  --root "$ROOT" \
  --output-dir deploylint-report-001 \
  --format json,sarif,html
report.jsonEXE-001 / high

ACTION_REQUIRED

Pull-request title reaches a shell command.

source
deploy.yml:42
path
pull_request.title → run
evidence
GitHub context is interpolated into executable shell text.
next move
Pass the value as an argument instead of shell text.
The deliverable

Evidence your reviewer can use in the same pull request.

The report is tied to the exact manifest bytes and independently supplied SHA-256 authority. A second person can verify what was admitted, what was checked, and why the result is actionable or inconclusive.

  • report.jsonMachine-readable findings and diagnostics.
  • report.sarifPortable findings for code-scanning workflows.
  • report.htmlLoopback-served reviewer view.
  • run-manifest.jsonEvidence identity for the scan.
Make the buying decision quickly

Useful when the workflow is yours to fix.

Buy this if you need to

  • Review a risky deploy workflow before merging it.
  • Keep workflow source inside a regulated or private environment.
  • Give a reviewer reproducible evidence instead of a dashboard score.
  • Start with five narrow checks rather than adopt a hosted platform.

Do not buy this if you need

  • Repository discovery, hosted scanning, or continuous monitoring.
  • Cloud IAM, dependency, secret, or application-code analysis.
  • Workflow execution or an automatic “safe to deploy” verdict.
  • A compliance certificate or a security warranty.
Private beta / five customer limit

One team. One workflow review. $149 once.

The pilot is a signed, local CLI and a focused findings review—not a subscription and not an indefinite support promise.

  1. Pay securely.Stripe checkout; one-time USD 149.
  2. Receive the bundle.Delivery to the payment email within one business day.
  3. Run and review.Up to five workflow files and one 30-minute onboarding or results session.
Before payment

Three answers that matter.

Does source leave my machine?

No. DeployLint reads only explicitly admitted local files. It does not clone, upload, fetch URLs, execute workflows, read credentials, or send telemetry.

What do exit codes tell my team?

0 means no action is required in the supplied scope. 1 means an actionable finding exists. 2 means evidence is incomplete or inconclusive. 3 is a safety or integrity hold. 4 is an invalid invocation or manifest.

What does “clean” not cover?

It does not assess cloud IAM, repository settings, dependencies, called workflows, secrets, or runtime behavior outside the exact files and policy you provide.