The whole ruleset targets a specific failure: workflow files that were written once, pinned to a tag, and never revisited — which is how supply-chain changes get in without anyone approving them. Findings come with a file and a line, and the fix plan is text you apply yourself, so nothing is rewritten behind you. It says plainly that it is not a security audit; treat a clean result as a clean maintenance check, not as an all-clear.
A local checker for CI hygiene. It reads workflow files and update-automation config in place, applies a fixed ruleset, and reports findings by category. It makes no network requests, changes no files, and runs nothing from the repository.
- A scan of a local repository returning findings by category, each with the file, the line and a suggested fix
- Third-party actions pinned to a movable tag or branch rather than a commit SHA, flagged as what they are — a dependency that can change under you
- Workflow token permissions that are write-all, and workflows with no explicit permissions block at all
- Whether update automation is present, since a repository with no Dependabot or Renovate config drifts silently
- Context-dependent patterns marked for human review rather than auto-judged, such as pull_request_target and script injection shapes
- Any rule explained in plain language on its own, by rule id or category, with no file access and no network
- A step-by-step fix plan as text for a rule, optionally with a repository path for context — it never edits anything, so applying the change stays your decision
Nothing to authorize; it runs as npx -y taskbounty-check mcp and reads files on your machine. The default path makes no outbound requests, uploads nothing and has no telemetry. Pin the version in committed config and CI rather than tracking latest, if you want the same rules run to run. Know its scope: this is maintenance and hygiene on GitHub Actions and update automation, and it deliberately does not check exposed secrets, authentication, payments, webhooks or runtime behaviour. The same package runs as a CLI and a GitHub Action that writes a counts-only summary into the workflow run.
One command — npx -y taskbounty-check@latest mcp