{
  "schema_version": 1,
  "id": "ci-github-actions-security",
  "track": "coding",
  "name": "CI GitHub Actions Security",
  "version": "0.1.0",
  "sha256": "3e3632193dfc017a783f4ef0d5dd5748609e7f129f233182671278a32ff3caba",
  "sha256_v1": "a645e2c1222179bcecc160cffbe72166810114fef5171f932c2ec11dec9aa386",
  "keyword": "block",
  "word": "blocks",
  "says": "blocks on an agent's file writes and at turn end",
  "description": "Friction, not a security boundary: refuses or asks (each rule's tier) on GitHub Actions weaknesses a change adds to workflows, composite actions and dependabot.yml: event text in run/script, PR-head checkout under pull_request_target/workflow_run/issue_comment, missing or write-all permissions, secrets inherit or inlined, self-hosted runners on PRs, GITHUB_ENV writes, artifact and cache poisoning, agent steps on untrusted text. Misses: step outputs, composite internals, custom runner labels.",
  "misses": "step outputs, composite internals, custom runner labels.",
  "where": [
    "write",
    "turn-end"
  ],
  "groups": [
    "ci-pipeline"
  ],
  "eval_cases": 43,
  "eval_executed": 43,
  "latest": {
    "version": "0.1.0",
    "date": "2026-10-04",
    "change": "Promoted from observe to enforce (D15). The pack cleared D15 with a fire rate of 0.6% over the catalog's full first-parent history (154 commits, chock-catalog#223; one adopter not measured). The manifest moves from action: warn / enforcement: advise to action: block / enforcement: block, the ceiling; the script already exits 1 for a block-tier rule and 3 for an ask-tier one, so each rule now lands on its roadmap default (section 6 ci-github-actions-security table). Eval cases that expected warn now expect that tier. No detection, scope or threshold change."
  },
  "agent_labels": {
    "claude-code": {
      "keyword": "block",
      "says": "blocks on an agent's file writes and at turn end"
    },
    "cursor": {
      "keyword": "block",
      "says": "blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point"
    },
    "codex": {
      "keyword": "block",
      "says": "blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)"
    },
    "copilot": {
      "keyword": "block",
      "says": "blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)"
    },
    "devin": {
      "keyword": "block",
      "says": "blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (vendor docs only, not witnessed)"
    },
    "grok": {
      "keyword": "ungraded",
      "says": "Not graded yet for Grok"
    },
    "goose": {
      "keyword": "ungraded",
      "says": "Not graded yet for goose"
    },
    "antigravity": {
      "keyword": "ungraded",
      "says": "Not graded yet for Antigravity"
    },
    "openhands": {
      "keyword": "ungraded",
      "says": "Not graded yet for OpenHands"
    },
    "kimi-code": {
      "keyword": "ungraded",
      "says": "Not graded yet for Kimi Code"
    },
    "factory-droid": {
      "keyword": "ungraded",
      "says": "Not graded yet for Factory Droid"
    }
  },
  "source_url": "https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/ci-github-actions-security",
  "enforces": "enforced-at-commit",
  "examples": [
    {
      "word": "Refused",
      "prompt": "An issue-triage workflow echoes the issue title inside run:.",
      "command": null
    },
    {
      "word": "Allowed",
      "prompt": "The title is passed through env: and read as a quoted variable.",
      "command": null
    }
  ]
}