1---2name: ci-assessment3description: READ-ONLY CI/CD pipeline security assessment for GitHub Actions, dependency security, and software supply chain4---56# CI/CD Pipeline Security Assessment78READ-ONLY CI/CD security assessment using gh CLI and local filesystem inspection. No repositories, workflows, or configurations are modified. Focused on GitHub Actions but includes dependency and supply chain checks applicable to any CI platform.910## Prerequisites11121. **gh CLI installed and authenticated** — `gh auth status`132. **Repository access** — read access to target repository143. **For dependency_audit** — local checkout of the repository1516```bash17# Quick prerequisite check18gh auth status # verify GitHub auth19gh repo view OWNER/REPO # verify repo access20```2122## Assessment Phases2324### Phase 1 — GitHub Actions Workflow Security2526| Check | Command | Risk |27|-------|---------|------|28| Dangerous triggers | `ci_audit github_actions_audit --repo OWNER/REPO` | pull_request_target, workflow_dispatch injection |29| Script injection | `ci_audit github_actions_audit --repo OWNER/REPO` | ${{ github.event.* }} in run blocks |30| Token permissions | `ci_audit github_permissions_audit --repo OWNER/REPO` | Missing or overly broad GITHUB_TOKEN scope |31| Action pinning | `ci_audit github_actions_pinning_audit --repo OWNER/REPO` | Unpinned third-party actions (tag poisoning) |3233### Phase 2 — Secrets & Runner Security3435| Check | Command | Risk |36|-------|---------|------|37| Secret leakage | `ci_audit github_secrets_exposure_audit --repo OWNER/REPO` | Secrets in logs, env dumps, artifacts |38| Self-hosted runners | `ci_audit github_runner_audit --repo OWNER/REPO` | Runner persistence, PR-triggered execution |3940### Phase 3 — Repository Security4142| Check | Command | Risk |43|-------|---------|------|44| Branch protection | `ci_audit github_branch_protection_audit --repo OWNER/REPO` | Missing reviews, force push, no status checks |4546### Phase 4 — Dependency & Supply Chain4748| Check | Command | Risk |49|-------|---------|------|50| Dependency security | `ci_audit dependency_audit --path /path/to/repo` | Unpinned deps, no lockfile, known vulns |51| Supply chain | `ci_audit supply_chain_audit --repo OWNER/REPO --path /path` | No Dependabot, missing CODEOWNERS, hardcoded tokens |5253## Detection Scope5455| Category | What We Check | What We Don't |56|----------|---------------|---------------|57| **Workflows** | Triggers, injection, permissions, pinning | Runtime behavior, actual secret values |58| **Secrets** | Exposure patterns in YAML | Actual secret content or rotation status |59| **Runners** | Self-hosted presence, risky triggers | Runner OS hardening, network isolation |60| **Branch Protection** | Rule configuration | Bypass via admin override audit trail |61| **Dependencies** | Versions, lockfiles, known CVEs | Transitive dependency behavior |62| **Supply Chain** | Automation config, CODEOWNERS | SBOM completeness, SLSA compliance level |6364## Program Reference6566| Program | Focus | Tool |67|---------|-------|------|68| github_actions_audit | Trigger analysis, script injection | gh API |69| github_permissions_audit | GITHUB_TOKEN scope | gh API |70| github_actions_pinning_audit | SHA pinning vs tag references | gh API |71| github_secrets_exposure_audit | Secret leakage patterns | gh API |72| github_runner_audit | Self-hosted runner risks | gh API |73| github_branch_protection_audit | Protection rule analysis | gh API |74| dependency_audit | Lockfile, versions, npm audit | local + npm |75| supply_chain_audit | Dependabot, CODEOWNERS, .npmrc | gh API + local |
cyberstrikeus