pipeline
5 guardrails, all at version v1.
| Guardrail | Default severity | What it checks |
|---|---|---|
pipeline/actions-pinned-by-digest | error | Every third party action a workflow uses is pinned to a full commit sha rather than to a tag or a branch. |
pipeline/job-timeout-set | info | Every job declares how long it may run, so a hung job is cut off rather than holding a runner until the platform's own limit. |
pipeline/least-privilege-token | error | Every workflow declares permissions, and none of them takes write access to everything. |
pipeline/no-script-injection | error | No run step interpolates a ${{ }} expression an outsider controls, such as a pull request title or a branch name, straight into the shell body. |
pipeline/no-untrusted-checkout | error | No workflow triggered by pull_request_target, issue_comment or workflow_run checks out a revision of its own choosing, or passes the request's revision into a command. |
Shared inputs
Every pipeline guardrail declares these inputs, and each one may add its own.
| Input | Description | Default |
|---|---|---|
pipelines | Comma separated globs naming the pipeline definitions to read. | .github/workflows/*.yml,.github/workflows/*.yaml,.gitlab-ci.yml,azure-pipelines*.yml,Jenkinsfile |
Shared collectors
Every pipeline guardrail is handed the facts these collectors gather, and each one may ask for more of its own.
| Collector | Gathers |
|---|---|
workflow | The pipeline definitions in the checkout, read as they are written: which triggers start them, what permissions they hand a job, which runner each job asks for, and every action a step reaches for and how tightly it is pinned. Names and shapes only, never a secret, an input value or an environment value. |
Every guardrail in this category is configured the same way, in the guardrails.checks array of buildnote.json. See Configuring guardrails for every option, and Guardrails to search the whole library.