GitHub Actions / CI/CD security

A security scanner for the workflow that deploys your software.

DeployLint is a local-first GitHub Actions security scanner for teams that want to inspect deployment workflows before release. It follows trust edges from event to runner to deploy and returns evidence a reviewer can act on.

Buy the $149 pilot See a sample finding →
Scope in one line Named workflow files → inert YAML → bounded findings No repository checkout. No execution. No upload.
01 / the problem

Deployment workflows are trust paths, not just YAML.

A GitHub Actions file can be syntactically valid and still create a dangerous path. A privileged event may reach an untrusted checkout. A pull-request value may flow into a shell command. A mutable action reference may change what runs later. A self-hosted runner may sit at the end of that path.

Most generic CI linting produces a long checklist. DeployLint focuses on the handoffs that can change the trust level of a deployment, then names the source location and the next review action.

The useful question is not “is this workflow complex?” It is “what untrusted input can reach a privileged deployment edge?”
02 / the checks

Five narrow checks for GitHub Actions security.

The production-v1 rule set is intentionally small. It does not claim to replace repository review, cloud IAM analysis, or a full software supply-chain program.

TRG-001

Privileged triggers

Finds elevated workflow events connected to untrusted checkout or execution.

PER-001

Excess permissions

Compares deploy-job permissions with the owner policy you supply.

REF-001

Mutable references

Flags actions and reusable workflows that are not pinned to an immutable commit.

EXE-001

Untrusted shell input

Shows direct GitHub context interpolation into executable sinks.

RUN-001

Runner trust

Detects an untrusted path reaching a self-hosted or privileged runner.

COV-001: missing policy or context stays visible as inconclusive. DeployLint does not guess that unknown means clean.

03 / the method

How the local CI/CD workflow scan works.

  1. Name the files.Create an explicit manifest for the workflow and optional policy files you want reviewed. There is no repository discovery.
  2. Admit exact bytes.DeployLint records paths, byte counts, and SHA-256 digests, then reads regular files under the approved root.
  3. Parse as data.Safe YAML parsing rejects custom tags, duplicate keys, alias abuse, malformed documents, and resource-limit escapes. Nothing executes.
  4. Review the bundle.Get deterministic JSON, SARIF, HTML, and Markdown reports with stable finding IDs and source evidence.
$ deploylint manifest--workflow .github/workflows/deploy.yml --policy deploylint-policy.json
04 / the boundary

Security software should be clear about its blind spots.

DeployLint can inspect

  • Explicitly supplied GitHub Actions workflow and policy files
  • Triggers, permissions, references, expressions, sinks, and runner edges
  • Bounded source locations, findings, diagnostics, and file identity

DeployLint will not do

  • Clone a repository, discover extra files, or fetch an arbitrary URL
  • Execute a workflow, shell command, action, expression, or subprocess
  • Read credentials, send telemetry, or make an external network request
05 / the pilot

Start with the deploy workflow your team worries about most.

The proprietary customer-run beta is a one-time $149 pilot for one team and up to five workflow files. It includes the signed local CLI, verification material, policy template, installation guide, and one 30-minute findings review.

Buy the founding pilot

14-day refund policy. Your workflow source remains in your environment. Contact support.