github-actions

Bomly uses this chain when it finds github-actions evidence.

How github-actions resolves

github-actions-detector is a manifest parser — it walks .github/workflows/*.yml, .github/workflows/*.yaml, and .github/actions/*/action.yml and resolves every uses: reference to a package node (owner/repo@ref). No subprocess runs.

Network behavior

✅ Fully offline-safe. Bomly does not contact GitHub during graph resolution.

Prerequisites

• A .github/workflows/ directory containing at least one workflow YAML file (*.yml or *.yaml).
• For custom composite actions, .github/actions/<name>/action.yml. The detector follows nested action references inside the same repo.
• No GitHub CLI or authentication is required — the YAML files are parsed locally.

--install-first

github-actions does not support --install-first. There is nothing to install.

Reference styles

The detector treats two uses: patterns differently:

• Tag references (uses: actions/checkout@v4) — resolved by name; advisories applying to a tag range match.
• Commit SHA references (uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29) — pinned to that exact commit; advisories that mention the SHA still match.

GitHub's security hardening guide recommends pinning third-party actions to commit SHAs. Bomly does not enforce the policy itself, but the JSON output exposes the reference type so you can build it into a custom auditor.

Examples

Fix a vulnerable action

Bump the action version in the workflow file:

- uses: actions/checkout@v4    # was @v3

Re-scan.

Audit which workflow introduces an action

bomly explain actions/checkout

Reachability

Not applicable. Every referenced action is treated as "imported"; --analyze produces not_applicable for GitHub Actions.

Limitations

• Dynamic action references (e.g. uses: ${{ matrix.action }}@v1) are skipped — the detector requires a static uses: string.
• Reusable workflows (uses: ./.github/workflows/x.yml@main) are recorded as edges but the referenced workflow's own uses: declarations are only walked when the referenced file is in the same repo.
• Docker-based actions (uses: docker://…) are recorded with the image ref; advisory matching uses the image rather than the source action repo.
• JavaScript action node-modules are not recursed into. The detector tracks the action repo, not the npm packages bundled inside its dist/ directory.