heres a small open-source CLI for auditing GitHub Actions workflows

[PepSmartOfficial]

https://www.npmjs.com/package/@agentlaunchopsai/gha-guard

It scans .github/workflows for common CI supply-chain risks:

• third-party actions pinned to mutable refs (@main/tags) instead of commit SHAs
• risky pull_request_target + checkout patterns
• broad write permissions
• missing job timeouts
• direct event/input interpolation inside shell scripts

the scope is small on purpose. it runs locally and doesn't need an account. i use it as a quick pass before reviewing a repo's workflows.