Loading GitHub Actions Supply-Chain Firewall...

Use this when

You review a repository before publishing packages, deploying infrastructure, releasing a product or accepting external PRs.
You need a quick hardening packet for workflow triggers, permissions, action pinning, cache/artifact boundaries and secret exposure.
You want a reviewer-readable CSV/YAML/Markdown packet instead of a vague CI checklist.

Boundary

This is static pasted-YAML triage. It does not inspect live repository settings or resolve action SHAs.
Verify with GitHub repository/org settings, branch protection, CODEOWNERS, Scorecard, CodeQL and human security review.
Do not paste secrets, private tokens, customer data, unreleased incidents or confidential vulnerability details.

Why this is different

Most workflow scanners stop at “you used an old action tag.” This firewall looks for dangerous combinations: privileged triggers plus untrusted code, broad write tokens plus secrets, workflow-run artifacts plus deploy steps, cache restore in release jobs and shell injection from event context.