github

11 guardrails, all at version v1.

Guardrail	Default severity	What it checks
`github/actions-pinned-by-digest`	`error`	Every third party action a workflow uses is pinned to a full commit sha rather than to a tag or a branch.
`github/codeowners-catch-all`	`warning`	`CODEOWNERS` declares a rule matching every path, so a file nobody thought about still has an owner.
`github/codeowners-no-unowned-rules`	`error`	No rule in `CODEOWNERS` names an empty set of owners, which would take ownership away from everything it matches.
`github/codeowners-owners-per-rule`	`warning`	Every rule in `CODEOWNERS` names at least the minimum owners and no more than the maximum, so review is neither one person's bus factor nor everybody's problem.
`github/codeowners-parses`	`error`	Every line of `CODEOWNERS` that is not a comment reads as a rule to GitHub, so no ownership is silently lost to a line GitHub ignores.
`github/codeowners-present`	`warning`	The repository carries a `CODEOWNERS` file where GitHub looks for one, naming at least one rule, so every change has somebody to review it.
`github/codeowners-team-owned`	`warning`	Every rule in `CODEOWNERS` names at least one GitHub team, so ownership survives the people currently in it.
`github/job-timeout-set`	`info`	Every job declares how long it may run, so a hung job is cut off rather than holding a runner until GitHub's own limit.
`github/least-privilege-token`	`error`	Every workflow declares `permissions`, and none of them takes write access to everything.
`github/no-script-injection`	`error`	No `run` step interpolates a `${{ }}` expression an outsider controls, such as a pull request title or a branch name, straight into the shell body.
`github/no-untrusted-checkout`	`error`	No workflow triggered by `pull_request_target`, `issue_comment` or `workflow_run` checks out a revision of its own choosing, or passes the request's revision into a command.

Shared inputs

Every github guardrail declares these inputs, and each one may add its own.

Input	Description	Default
`workflows`	Comma separated globs naming the workflows to read.	`.github/workflows/.yml,.github/workflows/.yaml`

Shared collectors

Every github guardrail is handed the facts these collectors gather, and each one may ask for more of its own.

Collector Gathers

github What GitHub itself reads out of the repository: the Actions workflows in .github/workflows, read as they are written, and the CODEOWNERS file, read as rules. For a workflow, which events start it, what token permissions it hands a job, which runner each job asks for, and every action a step reaches for and how tightly it is pinned. For CODEOWNERS, every pattern in file order with the owners it names, and the owners that apply to the paths a guardrail asks about, resolved the way GitHub resolves them, where the last rule to match a path is the one that owns it. Names and shapes only, never a secret, an input value or an environment value.

Collector	Gathers
`github`	What GitHub itself reads out of the repository: the Actions workflows in `.github/workflows`, read as they are written, and the CODEOWNERS file, read as rules. For a workflow, which events start it, what token permissions it hands a job, which runner each job asks for, and every action a step reaches for and how tightly it is pinned. For CODEOWNERS, every pattern in file order with the owners it names, and the owners that apply to the paths a guardrail asks about, resolved the way GitHub resolves them, where the last rule to match a path is the one that owns it. Names and shapes only, never a secret, an input value or an environment value.

Every guardrail in this category is configured the same way, in the guardrails.checks array of buildnote.json. See Configuring guardrails for every option, and Guardrails to search the whole library.

github ​

Shared inputs ​

Shared collectors ​

github

Shared inputs

Shared collectors