Checks

Scan GitHub Actions workflow files for security issues such as template injection, excessive permissions, unpinned actions, and other misconfigurations using the zizmor static analysis tool.

GitHub Actions organization settings define whether workflows are allowed to create and approve pull requests.

The evaluation determines whether that permission is disabled, so that approving a pull request always requires a human reviewer.

GitHub organization base repository permission for members uses a strict setting such as read or none rather than permissive options like write or admin. Applies to members, not outside collaborators.

GitHub Actions organization settings define the default GITHUB_TOKEN permissions granted to every workflow run.

The evaluation determines whether the organization default is read-only, so that workflows have to opt in to write access through an explicit permissions block.

GitHub organization settings require all members to use two-factor authentication (2FA).

The evaluation determines whether access to organization resources is conditioned on members having 2FA enabled.

GitHub organization repository creation is restricted so that only trusted owners or specific teams can create new repositories within the organization.

Ensure repository deletion/transfer is restricted so only trusted organization users (owners) can delete or transfer repositories.

GitHub organization has a verified badge.

GitHub repository setting that enables automatic deletion of head branches when pull requests merge into the default branch (delete_branch_on_merge).

GitHub repository default branch have branch protections or rulesets with Allow deletions disabled.

GitHub repository default branch blocks force pushes through branch protection.

Evaluates whether the default branch permits force pushes. This protection can be enforced through classic branch protection or repository rulesets.

GitHub repository default branch ensures that when new commits are pushed to an open pull request, any previously granted approvals are automatically dismissed, requiring fresh reviews before the pull request can be merged.

GitHub repository default branch applies branch protection rules to administrators via enforce_admins, holding admin pushes to the same requirements as other contributors (reviews, status checks, and push restrictions). This protection can be enforced through classic branch protection or repository rulesets.

GitHub repository default branch has branch protection rules enabled to restrict direct changes and require reviewed, validated merges. The evaluation determines whether the default branch enforces such rules. This protection can be enforced through classic branch protection or repository rulesets.

GitHub repository default branch requires Code Owners approval for pull requests that modify paths declared in CODEOWNERS. This protection can be enforced through classic branch protection or repository rulesets.

GitHub repository default branch uses branch protection to require conversation resolution on pull requests (Require conversation resolution before merging). This protection can be enforced through classic branch protection or repository rulesets.

GitHub repository default branch enforces Require linear history, blocking merge commits and allowing only squash or rebase merges. This protection can be enforced through classic branch protection or repository rulesets.

GitHub repository default branch enforces required reviews with a minimum of 2 approving reviews before a pull request can be merged.

Assesses whether an approval threshold of at least 2 is configured for code changes targeting the default branch. This protection can be enforced through classic branch protection or repository rulesets.

GitHub repository default branch enforces signed and verified commits (Require signed commits), allowing only commits with valid cryptographic signatures to be pushed or merged. This protection can be enforced through classic branch protection or repository rulesets.

GitHub repository default branch uses required status checks, indicating whether merges are gated by successful check results on pull requests. This protection can be enforced through classic branch protection or repository rulesets.

GitHub Actions repository settings define the default GITHUB_TOKEN permissions granted to every workflow run in the repository.

The evaluation determines whether the repository default is read-only, so that workflows have to opt in to write access through an explicit permissions block.

GitHub repositories are assessed for dependency vulnerability scanning enabled via Dependabot alerts, which monitors the dependency graph for known vulnerable packages and versions.

GitHub repositories declare code ownership via a CODEOWNERS file mapping file patterns to users or teams. This evaluation checks whether such a file exists in standard locations (/, .github/, or docs/) to enable automatic reviewer assignment.

GitHub repository has immutable releases enabled to prevent modification or replacement of published artifacts after publication. When enabled, release assets and binaries become tamper-proof, ensuring artifact integrity throughout the software supply chain.