gh-actions-doctor rules focus on GitHub Actions security, reliability, performance, cost, correctness, and maintainability.
| Rule | Category | Description |
|---|---|---|
missing-permissions |
security | Detects workflows without an explicit top-level permissions block. |
mutable-action-reference |
security | Detects actions referenced by mutable refs such as main, master, or latest. |
action-not-sha-pinned |
security | Detects third-party actions that are not pinned to a full commit SHA. |
risky-pull-request-target |
security | Detects risky pull_request_target usage. |
missing-timeout |
reliability | Detects jobs without timeout-minutes. |
missing-concurrency |
cost | Detects workflows likely to benefit from concurrency. |
setup-node-cache-missing |
performance | Detects actions/setup-node without dependency caching. |
broad-push-trigger |
cost | Detects broad push triggers without branch, tag, or path filters. |
duplicate-workflow-name |
maintainability | Detects repeated workflow names across files. |
overbroad-id-token-permission |
security | Detects unused id-token: write permissions. |
pull-request-target-untrusted-checkout |
security | Detects unsafe checkout of pull request head code in pull_request_target. |
untrusted-expression-in-run |
security | Detects untrusted event data interpolated directly into shell commands. |
remote-script-execution |
security | Detects run steps that pipe remote scripts directly to a shell. |
secret-echo-risk |
security | Detects steps that appear to echo or redirect secret values. |
New rules should include focused tests, rule docs, and README updates.