github

11 guardrails, all at version v1.

Guardrail	Default severity	What it checks
`github/actions-pinned-by-digest`	`error`	Every third-party action a workflow uses is pinned to a full commit sha, not to a tag or a branch.
`github/codeowners-catch-all`	`warning`	`CODEOWNERS` has a rule matching every path, so even a file nobody thought about has an owner.
`github/codeowners-no-unowned-rules`	`error`	No rule in `CODEOWNERS` has an empty list of owners, which would remove ownership from everything it matches.
`github/codeowners-owners-per-rule`	`warning`	Every rule in `CODEOWNERS` names at least the minimum and at most the maximum number of owners, so review neither depends on one person nor becomes everybody's problem.
`github/codeowners-parses`	`error`	Every line of `CODEOWNERS` that is not a comment is a rule GitHub can read, so no ownership is silently lost to a line GitHub ignores.
`github/codeowners-present`	`warning`	The repository has a `CODEOWNERS` file where GitHub looks for one, with at least one rule, so every change has someone to review it.
`github/codeowners-team-owned`	`warning`	Every rule in `CODEOWNERS` names at least one GitHub team, so ownership outlasts the people currently on it.
`github/job-timeout-set`	`info`	Every job declares how long it may run, so a hung job is stopped instead of holding a runner until GitHub's own limit.
`github/least-privilege-token`	`error`	Every workflow declares `permissions`, and none of them grants write access to everything.
`github/no-script-injection`	`error`	No `run` step interpolates a `${{ }}` expression an outsider controls, such as a pull request title or a branch name, straight into the shell body.
`github/no-untrusted-checkout`	`error`	No workflow triggered by `pull_request_target`, `issue_comment` or `workflow_run` checks out a revision of its own choosing, or passes the request's revision into a command.

Shared inputs

Every github guardrail declares these inputs. Individual guardrails can add their own.

Input	Description	Default
`workflows`	Comma separated globs naming the workflows to read.	`.github/workflows/.yml,.github/workflows/.yaml`

Shared collectors

Every github guardrail receives the facts these collectors gather. Individual guardrails can ask for more collectors of their own.

Collector Gathers

github What GitHub itself reads out of the repository: the Actions workflows in .github/workflows, read as they are written, and the CODEOWNERS file, read as rules. For a workflow, which events start it, what token permissions it hands a job, which runner each job asks for, and every action a step reaches for and how tightly it is pinned. For CODEOWNERS, every pattern in file order with the owners it names, and the owners that apply to the paths a guardrail asks about, resolved the way GitHub resolves them, where the last rule to match a path is the one that owns it. Names and shapes only, never a secret, an input value or an environment value.

Collector	Gathers
`github`	What GitHub itself reads out of the repository: the Actions workflows in `.github/workflows`, read as they are written, and the CODEOWNERS file, read as rules. For a workflow, which events start it, what token permissions it hands a job, which runner each job asks for, and every action a step reaches for and how tightly it is pinned. For CODEOWNERS, every pattern in file order with the owners it names, and the owners that apply to the paths a guardrail asks about, resolved the way GitHub resolves them, where the last rule to match a path is the one that owns it. Names and shapes only, never a secret, an input value or an environment value.

You configure every guardrail in this category the same way, in the guardrails.checks array of buildnote.json. Configuring guardrails lists every option, and Guardrails lets you search the whole library.

github ​

Shared inputs ​

Shared collectors ​

github

Shared inputs

Shared collectors