github-actions
GitHub Actions workflows: valid syntax and expressions, security audits, and pinned actions.
Checks
Section titled “Checks”| Check | Stage | Level | What it does |
|---|---|---|---|
github-actions/actionlint |
commit |
recommended |
Checks every GitHub Actions workflow with actionlint: syntax, expressions, action inputs, and shell steps. |
github-actions/zizmor |
commit |
recommended |
Audits GitHub Actions workflows and composite actions with zizmor for template injection, excessive permissions, and dangerous triggers. |
Selected when
Section titled “Selected when”gspot selects it in a scope with file paths **/.github/workflows/*.{yml,yaml}, **/action.{yml,yaml}.
Rules for coding agents
Section titled “Rules for coding agents”| Rule file | Installed when |
|---|---|
.gspot/configurations/infrastructure/github-actions/rules/GITHUB-ACTIONS.md |
Always |
Tools and versions
Section titled “Tools and versions”| Tool | Version |
|---|---|
| actionlint | 1.7.12 |
| shellcheck | 0.11.0 |
| zizmor | 1.30.1 |
Files gspot writes
Section titled “Files gspot writes”gspot writes .gspot/configurations/infrastructure/github-actions/zizmor.yml.