github-script-danger

Maintainer tooling for teams that embed JavaScript in GitHub Actions via actions/github-script: those steps often hide eval, new Function, environment dumps, and curl|bash pipes that a generic workflow linter will miss. github-script-danger is a deterministic, offline scanner that only inspects actions/github-script with.script bodies — narrower than full suites like zizmor, and focused where dynamic JS privilege lives.

60-second quickstart

bash

# from the repository root
npm install
npm test
npx tsx src/cli.ts --help
npx tsx src/cli.ts fixtures/dangerous   # exit 1 + markdown report
npx tsx src/cli.ts fixtures/safe        # exit 0

PowerShell

# from the repository root
npm install
npm test
npx tsx src/cli.ts --help
npx tsx src/cli.ts fixtures/dangerous   # exit 1 + markdown report
npx tsx src/cli.ts fixtures/safe        # exit 0

Build + binary

npm run build
node dist/cli.js fixtures/allowlisted

What it flags

Rule id	Pattern
eval	eval(...)
new-function	new Function(...)
secret-env-dump	console.log(process.env), JSON.stringify(process.env), dumping secrets/env objects
curl-pipe-bash	curl … | bash, wget … | sh, curl|bash

Only steps with uses: actions/github-script@… are inspected. A neighboring run: shell step with the same strings is ignored (by design — use a shell/injection linter for those).

Allowlist config

Place .github-script-danger.yml at the scan root:

allowlist:
  - rule: eval
    file: .github/workflows/admin.yml
    job: admin
    step: controlled-eval
    reason: Maintainer-only workflow with pinned trusted input

# optional — default is all rules
enabled-rules:
  - eval
  - new-function
  - secret-env-dump
  - curl-pipe-bash

rule: "*" suppress all rules for the matched file/job/step. Fixture: fixtures/allowlisted/.

CLI

github-script-danger [rootDir] [options]

  -c, --config <path>        Config file
  -f, --format <name>        markdown | sarif | both
  -o, --output <path>        Write markdown report
      --sarif-output <path>  Write SARIF
      --include-allowlisted  Keep suppressed findings in output
  -h, --help

Exit 1 when any non-allowlisted finding exists.

Composite Action inputs

Input	Default	Description
root-dir	.	Scan root
config	(empty)	Config path
format	markdown	markdown / sarif / both
fail-on-findings	true	Fail job on findings
markdown-path	(empty)	Optional markdown output path
sarif-path	results.sarif	SARIF path when format includes sarif

- uses: ./
  with:
    root-dir: .
    format: both
    markdown-path: gsd-report.md
    sarif-path: gsd-results.sarif

Fixtures

Path	Expectation
fixtures/dangerous	Findings for all four rules; exit 1
fixtures/safe	Clean github-script; exit 0
fixtures/allowlisted	eval suppressed by config; exit 0

Install / test / demo (from package dir)

npm install
npm test
node --import tsx src/cli.ts --help
node --import tsx src/cli.ts fixtures/dangerous

v0.2 limitations (honest)

• Does not parse obfuscated JS (Function.constructor, base64-decoded payloads, multi-step indirection).
• Does not follow script loaded from files via path / external downloads — only inline with.script.
• Does not analyze actions/github-script inputs other than script (for example github-token privilege).
• Regex-based detectors can false-positive on commented-out examples inside the script string.
• Not a substitute for pinact, gitleaks, or a full workflow security suite.

License

MIT