Audit a CI workflow for what it leaves movable or undeclared

{
  "contract": {
    "required_jobs": [
      "build",
      "publish",
      "lint"
    ]
  },
  "workflow": {
    "jobs": {
      "build": {
        "runs-on": "ubuntu-latest",
        "steps": [
          {
            "uses": "actions/checkout@v4"
          },
          {
            "uses": "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"
          },
          {
            "name": "Greet",
            "run": "echo \"Building ${{ github.event.pull_request.title }}\""
          },
          {
            "run": "npm ci && npm test"
          }
        ]
      },
      "notify": {
        "needs": [
          "publish",
          "lint"
        ],
        "runs-on": "ubuntu-latest",
        "steps": [
          {
            "run": "echo done"
          }
        ]
      },
      "publish": {
        "needs": "build",
        "permissions": {
          "contents": "read",
          "packages": "write"
        },
        "runs-on": "ubuntu-latest",
        "steps": [
          {
            "uses": "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"
          }
        ],
        "timeout-minutes": 15
      }
    },
    "name": "release",
    "on": {
      "pull_request_target": {},
      "push": {
        "branches": [
          "main"
        ]
      }
    }
  }
}

{
  "assumptions": [
    "An action pinned to a 40-character commit hash is pinned; a tag or branch can be moved by whoever owns the action, so the code a step runs can change without this file changing.",
    "The on key is read from either on or true, because an unquoted on is a YAML boolean and survives conversion to JSON that way.",
    "Findings describe patterns in the document. Naming pull_request_target or an interpolated expression is reporting what the file says, not demonstrating an exploit."
  ],
  "complete": true,
  "conformant": false,
  "examined_job_count": 3,
  "finding_count": 10,
  "findings": [
    {
      "code": "REQUIRED_JOB_MISSING",
      "detail": "lint is required and not declared.",
      "job": "lint"
    },
    {
      "code": "PULL_REQUEST_TARGET_TRIGGER",
      "detail": "The workflow triggers on pull_request_target, which runs with repository write context against code from a fork. This reports the trigger, not an exploit."
    },
    {
      "code": "WORKFLOW_PERMISSIONS_NOT_DECLARED",
      "detail": "The workflow declares no permissions block, so it inherits whatever the repository default is rather than stating what it needs."
    }
  ],
  "findings_by_code": {
    "ACTION_NOT_PINNED_TO_COMMIT": 1,
    "JOB_DEPENDENCY_NOT_DECLARED": 1,
    "JOB_PERMISSIONS_NOT_DECLARED": 2,
    "JOB_TIMEOUT_MISSING": 2,
    "PULL_REQUEST_TARGET_TRIGGER": 1,
    "REQUIRED_JOB_MISSING": 1,
    "UNTRUSTED_INTERPOLATION_IN_RUN": 1,
    "WORKFLOW_PERMISSIONS_NOT_DECLARED": 1
  },
  "job_count": 3,
  "jobs": [
    {
      "job": "build",
      "needs": [],
      "permissions_declared": false,
      "runs_on": "ubuntu-latest",
      "steps": 4,
      "timeout_minutes": null,
      "unpinned_actions": [
        "actions/checkout@v4"
      ]
    },
    {
      "job": "publish",
      "needs": [
        "build"
      ],
      "permissions_declared": true,
      "runs_on": "ubuntu-latest",
      "steps": 1,
      "timeout_minutes": 15,
      "unpinned_actions": []
    },
    {
      "job": "notify",
      "needs": [
        "publish",
        "lint"
      ],
      "permissions_declared": false,
      "runs_on": "ubuntu-latest",
      "steps": 1,
      "timeout_minutes": null,
      "unpinned_actions": []
    }
  ],
  "limitations": [
    "Observable facts about the workflow supplied. Nothing is run, no action is fetched, and this is not a security assessment or a compliance determination.",
    "conformant is true only when every declared rule was evaluated and none failed."
  ],
  "limits": {
    "maxComponents": 5000,
    "maxDependencies": 5000,
    "maxFindings": 500,
    "maxJobs": 200,
    "maxResources": 2000,
    "maxServices": 200,
    "maxVariables": 1000
  },
  "not_examined": [],
  "observed_at": "2026-10-02T00:00:00.000Z",
  "passed": false,
  "request_id": "example-request",
  "service_id": "ci_workflow_contract_audit",
  "service_version": "1.0.0",
  "step_count": 6,
  "trigger_names": [
    "push",
    "pull_request_target"
  ],
  "unpinned_action_count": 1,
  "workflow_permissions_declared": false
}