GitHub Actions Security Auditor — Workflow Risk Monitor

Monitor public GitHub repositories for GitHub Actions security findings and see what changed since the previous successful scan.

This Actor uses zizmor as the static-analysis engine and adds an Apify product layer for scheduled/batch scanning, normalized Dataset output, persistent per-repository baselines, and NEW / STILL / RESOLVED change tracking.

What it solves

A one-time workflow security scan tells you what exists now. This Actor is designed for repeat monitoring:

• NEW — a finding appears that was not in the previous successful baseline.
• STILL — the same stable finding is still present.
• RESOLVED — a previous finding disappeared.

Stable fingerprints intentionally ignore row/column offsets, so ordinary line movement should not create fake new findings.

Input

{
  "repositories": [
    "actions/checkout",
    "https://github.com/zizmorcore/zizmor"
  ],
  "minSeverity": "low",
  "includeStill": true
}

Fields

• repositories — 1–20 public GitHub repositories. Use owner/repo or a repository-root GitHub URL.
• minSeverity — informational, low, medium, or high. Default: low.
• includeStill — when false, Dataset only emits NEW and RESOLVED; state still tracks all current findings.

No GitHub token is required in v0.1.

Output

Each Dataset row contains the normalized finding plus monitoring state:

{
  "repository": "owner/repo",
  "status": "NEW",
  "rule": "template-injection",
  "severity": "high",
  "confidence": "high",
  "workflowFile": ".github/workflows/ci.yml",
  "route": "jobs.build.steps[0]",
  "title": "code injection via template expansion",
  "documentationUrl": "https://docs.zizmor.sh/...",
  "findingKey": "sha256:...",
  "checkedAt": "2026-09-16T00:00:00.000Z"
}

OUTPUT summarizes repository successes/failures, current findings, NEW/STILL/RESOLVED counts, and current findings by severity.

Safety model

The Actor downloads a public GitHub repository archive into an Actor-controlled temporary directory and statically scans it with zizmor.

It does not:

• run repository workflows,
• run npm install or other package installs from the target repository,
• execute binaries or scripts from the target repository,
• auto-fix workflows,
• classify a repository or author as malicious.

A security finding means a static rule matched and should be reviewed in context. It is not a malware verdict.

State

A named key-value store, github-actions-security-auditor-state, stores the previous successful normalized findings for each canonical repository slug. Failed repository scans do not erase their previous baselines.

First successful scan: all current findings are NEW.

Later successful scans: findings become STILL, newly appearing fingerprints become NEW, and disappeared fingerprints become RESOLVED.

Current limitations

• Public GitHub repositories only.
• GitHub public archive/API limits can affect very large batches or frequent schedules.
• No organization-wide repository discovery.
• No private repository authentication.
• No automatic remediation or pull requests.
• v0.1 is the Apify validation product only; n8n/MCP/API/CLI adapters are intentionally not included until real user demand exists.

Attribution

Security detection is powered by zizmor, an MIT-licensed open-source GitHub Actions security analysis tool. 007 uses zizmor as an external dependency and does not copy or reimplement its audit rules.