Delivery & CI
8 rules
GitHub Actions
Declare Actions permissions GitHub workflows declare token permissions explicitly.
sarj/github/explicit-permissions warning Handle merge-group events An inspected workflow handles merge-group events when a merge queue is active. sarj/github/merge-queue-trigger warning Keep scanner failures blocking Recognized vulnerability scanner failures propagate to CI. sarj/github/vulnerability-gate warning Pin workflow dependencies Non-local workflow dependencies are pinned to immutable digests. sarj/github/actions-sha-pinning warning Set job timeouts Executable GitHub Actions jobs have explicit time bounds. sarj/github/job-timeouts warning Use lock-enforcing installs Recognized CI installs use lock-enforcing modes. sarj/github/immutable-installs warning