Action Blast Radius

Map the CI/CD blast radius of a GitHub Actions repository before a workflow becomes a supply-chain incident.

Action Blast Radius is a local web app and CLI that scans real .github/workflows YAML files. It identifies risky triggers, broad token permissions, unpinned actions, third-party actions running with write-capable tokens, secret references in privileged workflows, and checkout credential persistence.

Why this exists

GitHub Actions security issues are easy to hide in plain YAML. A maintainer may see pull_request_target, permissions: write-all, or a third-party action tag and not immediately understand the combined blast radius. Existing security scanners are valuable, but this project focuses on a readable local report that connects each finding to impact and a concrete fix.

Quickstart

python server.py

Open:

http://127.0.0.1:8775

Scan the included sample:

python radar.py sample-repo

Return JSON:

python radar.py sample-repo --json

Run the smoke test:

python scripts/smoke_test.py

Real data path

Use a local repository path, a .github/workflows folder, or a single workflow YAML file. The product reads local files only. No GitHub token or external API is required.

What it checks

• pull_request_target and workflow_run trust-boundary risk
• broad permissions: write-all
• high-impact write scopes such as contents: write, actions: write, pull-requests: write, and id-token: write
• action references that are not pinned to a full commit SHA
• third-party actions combined with write-capable tokens
• actions/checkout without persist-credentials: false
• secret references inside risky or privileged workflows

Scope

This is not a replacement for a full GitHub Actions static analyzer such as zizmor. It is a fast local blast-radius explainer for maintainers who want a readable first-pass report before merge or release.

License

MIT