sisakulint Rules #

sisakulint provides comprehensive security rules for GitHub Actions workflows. Rules are categorized by the security risks they address.

Security Rules Overview #

Code Injection / Poisoned Pipeline Execution (CICD-SEC-04) #

Rule	Severity	Description
code-injection-critical	Critical	Detects untrusted input in privileged workflow triggers
code-injection-medium	Medium	Detects untrusted input in normal workflow triggers
envvar-injection-critical	Critical	Detects untrusted input written to $GITHUB_ENV in privileged triggers
envvar-injection-medium	Medium	Detects untrusted input written to $GITHUB_ENV in normal triggers
envpath-injection-critical	Critical	Detects untrusted input written to $GITHUB_PATH in privileged triggers
envpath-injection-medium	Medium	Detects untrusted input written to $GITHUB_PATH in normal triggers
untrusted-checkout	Critical	Detects checkout of untrusted PR code in privileged contexts
untrusted-checkout-toctou-critical	Critical	Detects TOCTOU vulnerabilities with labeled event type and mutable refs
untrusted-checkout-toctou-high	High	Detects TOCTOU vulnerabilities with deployment environment and mutable refs
improper-access-control	Critical	Detects label-based approval bypass vulnerabilities
bot-conditions	High	Detects spoofable bot detection conditions
unsound-contains	Medium	Detects bypassable contains() function usage

Artifact and Cache Poisoning (CICD-SEC-09) #

Rule	Severity	Description
artifact-poisoning-critical	Critical	Detects artifact poisoning in privileged workflows
artifact-poisoning-medium	Medium	Detects artifact poisoning in normal workflows
cache-poisoning	High	Detects cache poisoning vulnerabilities
cache-poisoning-poisonable-step	High	Detects poisonable steps after unsafe checkout
artipacked	High	Detects credential leakage via persisted checkout credentials

Identity and Access Management (CICD-SEC-02) #

Rule	Severity	Description
permissions	High	Validates GITHUB_TOKEN permission scopes
secret-exposure	High	Detects excessive secrets exposure patterns
unmasked-secret-exposure	High	Detects unmasked secret exposure from fromJson()

Credential Hygiene (CICD-SEC-06) #

Rule	Severity	Description
credentials	High	Detects hardcoded credentials using Rego

Third Party Services (CICD-SEC-08) #

Rule	Severity	Description
action-list	Medium	Enforces action allowlist/blocklist policies
commit-sha	High	Validates commit SHA pinning in actions
known-vulnerable-actions	Critical	Detects actions with known security vulnerabilities
archived-uses	Medium	Detects usage of archived actions
impostor-commit	Critical	Detects impostor commits from fork network
ref-confusion	High	Detects ref confusion attacks
unpinned-images	Medium	Detects container images not pinned by SHA256

Workflow Validation #

Rule	Severity	Description
id	Low	Validates job and step IDs
job-needs	Low	Validates job dependencies
workflow-call	Medium	Validates reusable workflow calls
timeout-minutes	Medium	Ensures timeout-minutes is set

Expression and Syntax Validation #

Rule	Severity	Description
expression	Medium	Validates GitHub Actions expression syntax
conditional	Medium	Validates conditional expressions
environment-variable	Low	Validates environment variable names
deprecated-commands	High	Detects deprecated workflow commands

Runner Security #

Rule	Severity	Description
self-hosted-runners	High	Detects self-hosted runner usage in public repos

Obfuscation Detection #

Rule	Severity	Description
obfuscation	High	Detects obfuscated workflow patterns

Auto-Fix Support #

The following rules support automatic fixing with sisakulint -fix on:

timeout-minutes - Adds default timeout-minutes: 5
commit-sha - Converts action tags to commit SHAs
credentials - Removes hardcoded passwords
code-injection-critical/medium - Moves untrusted expressions to environment variables
envvar-injection-critical/medium - Sanitizes untrusted input before writing to $GITHUB_ENV
envpath-injection-critical/medium - Validates paths with realpath before writing to $GITHUB_PATH
untrusted-checkout - Adds explicit ref to checkout in privileged contexts
untrusted-checkout-toctou-critical/high - Fixes TOCTOU vulnerabilities
artifact-poisoning-critical/medium - Adds validation steps for artifact downloads
improper-access-control - Replaces mutable refs with immutable SHAs and changes event types
conditional - Removes unnecessary ${{ }} wrappers
secret-exposure - Converts bracket notation to dot notation
unmasked-secret-exposure - Adds ::add-mask:: command for derived secrets
bot-conditions - Replaces spoofable bot conditions with safe alternatives
artipacked - Adds persist-credentials: false to checkout steps
unsound-contains - Converts string literal to fromJSON() array format
impostor-commit - Pins action to commit SHA
ref-confusion - Pins action to commit SHA when ref confusion is detected
obfuscation - Normalizes obfuscated paths and shell commands
known-vulnerable-actions - Updates vulnerable actions to patched versions
cache-poisoning - Removes unsafe ref from checkout step

OWASP CI/CD Top 10 Mapping #

OWASP Risk	Description	sisakulint Rules
CICD-SEC-01	Insufficient Flow Control Mechanisms	improper-access-control, bot-conditions
CICD-SEC-02	Inadequate Identity and Access Management	permissions, secret-exposure, unmasked-secret-exposure
CICD-SEC-03	Dependency Chain Abuse	known-vulnerable-actions, archived-uses, impostor-commit, ref-confusion
CICD-SEC-04	Poisoned Pipeline Execution (PPE)	code-injection-, envvar-injection-, envpath-injection-, untrusted-checkout-, unsound-contains
CICD-SEC-05	Insufficient PBAC (Pipeline-Based Access Controls)	self-hosted-runners
CICD-SEC-06	Insufficient Credential Hygiene	credentials
CICD-SEC-07	Insecure System Configuration	timeout-minutes, deprecated-commands
CICD-SEC-08	Ungoverned Usage of 3rd Party Services	action-list, commit-sha, unpinned-images
CICD-SEC-09	Improper Artifact Integrity Validation	artifact-poisoning-, cache-poisoning-, artipacked
CICD-SEC-10	Insufficient Logging and Visibility	obfuscation