CI GitHub Actions Security
Blocks on an agent's file writes and at turn end.
Acts on
File write · Turn end
When
Before the file write · at turn end
Tested
43 of 43 pass
In a git repo
At commit
What it does
Friction, not a security boundary: refuses or asks (each rule's tier) on GitHub Actions weaknesses a change adds to workflows, composite actions and dependabot.yml: event text in run/script, PR-head checkout under pull_request_target/workflow_run/issue_comment, missing or write-all permissions, secrets inherit or inlined, self-hosted runners on PRs, GITHUB_ENV writes, artifact and cache poisoning, agent steps on untrusted text. Misses: step outputs, composite internals, custom runner labels.
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedBlocks Blocks on an agent's file writes and at turn endBuild →
- Cursor TestedBlocks Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either pointBuild →
- Codex TestedBlocks Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- GitHub Copilot TestedBlocks Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- Devin TestedBlocks Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (vendor docs only, not witnessed)Build →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
See it in action
Refused
An issue-triage workflow echoes the issue title inside run:.
Allowed
The title is passed through env: and read as a quoted variable.
Both examples are this policy's own test cases.
What it misses
Step outputs, composite internals, custom runner labels.
Latest change
0.1.0 · · Promoted from observe to enforce (D15). The pack cleared D15 with a fire rate of 0.6% over the catalog's full first-parent history (154 commits, chock-catalog#223; one adopter not measured). The manifest moves from action: warn / enforcement: advise to action: block / enforcement: block, the ceiling; the script already exits 1 for a block-tier rule and 3 for an ask-tier one, so each rule now lands on its roadmap default (section 6 ci-github-actions-security table). Eval cases that expected warn now expect that tier. No detection, scope or threshold change.