github-actions[bot]
published Aug 27, 2026, 4:15 AM · updated Aug 27, 2026, 4:15 AM
Daily action/setup/* Security Audit
Security audit of actions/setup/ completed. Aspects examined this run: file-permissions and command-injection (reuse), network-requests and supply-chain (new). Scanned ~180 non-test source files (js/.cjs and sh/.sh) plus package.json/package-lock.json.
Findings:
- supply-chain: lockfile has 322 packages, all pinned; only 1 without integrity is
@actions/github-scriptpinned to a git commit SHA (acceptable); deps are devDependencies only. No issue. - network-requests: runtime_import.cjs fetch uses redirect:"manual" + timeouts; models/API URLs host-validated. No SSRF/TLS gaps found.
- command-injection: all eval() usages are confined to *_test.sh harness files, not shipped code.
- file-permissions: credential configs (copilot mcp-config.json, codex config.toml) written with umask 077 + chmod 600; the config files are cat-ed to logs but the gateway apiKey is masked via ::add-mask:: before converters run. Prior mount_mcp_as_cli.cjs finding remains remediated (fchmodSync 0o700).
No new actionable (high/critical) findings. Cache state updated.
Generated from Daily action/setup/* Security Audit · 92.9 AIC · ⌖ 21.5 AIC · ◇ 8.46 AIC · ⊞ 9.3K · ◷