Policies
CI GitHub Actions Security
CI GitHub Actions Security: what it does, its label on each agent, what it misses, and examples.
Catalog policy ci-github-actions-security, version 0.1.0, labelled blocks on Claude Code.
What it does
Friction, not a security boundary: refuses or asks (each rule's tier) on GitHub Actions weaknesses a change adds to workflows, composite actions and dependabot.yml: event text in run/script, PR-head checkout under pull_request_target/workflow_run/issue_comment, missing or write-all permissions, secrets inherit or inlined, self-hosted runners on PRs, GITHUB_ENV writes, artifact and cache poisoning, agent steps on untrusted text. Misses: step outputs, composite internals, custom runner labels.
On each agent
| Agent | Label | What it does there |
|---|---|---|
| Claude Code | Blocks | Blocks on an agent's file writes and at turn end |
| Cursor | Blocks | Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point |
| Codex | Blocks | Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run) |
| GitHub Copilot | Blocks | Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run) |
| Devin | Blocks | Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (vendor docs only, not witnessed) |
| Grok | Not graded | Not graded yet for Grok |
| goose | Not graded | Not graded yet for goose |
| Antigravity | Not graded | Not graded yet for Antigravity |
| OpenHands | Not graded | Not graded yet for OpenHands |
| Kimi Code | Not graded | Not graded yet for Kimi Code |
| Factory Droid | Not graded | Not graded yet for Factory Droid |
What it misses
Step outputs, composite internals, custom runner labels.
Examples from its eval suite
Refused: An issue-triage workflow echoes the issue title inside run:.
Allowed: The title is passed through env: and read as a quoted variable.
More
Built from engine 5a4b6287a46e and catalog 1e60d211c1bb.