dsh-ci-guard: Scanning GitHub Actions Workflows for DeepSeek Harness
feely0208/dsh-ci-guard
A DeepSeek Harness plugin that audits CI workflows, scanning GitHub Actions configs for exploitable supply-chain risks such as unpinned actions, over-broad permissions, and script injection.
dsh-ci-guard is a CI workflow security plugin for DeepSeek Harness that inspects GitHub Actions for configurations an outside party could exploit. It targets the most common supply-chain entry point: when a workflow references an unpinned action, a compromised upstream account means the next CI run executes under an attacker's control, with your secrets in reach. Findings are graded high, medium, and low, covering unpinned actions, write-all permissions, echoed secrets, script injection, and the pull_request_target case that needs human judgment, with rule listings and HTML report output.
How to Install
dsh plugin --profile web add @deepwhale-cn/dsh-ci-guard- Category
- Development & Operations
- Platform
- DSH Plugin
- Author
- feely0208
- Distribution
- Plugin
dsh-ci-guard Key Features
dsh-ci-guard Repo Summary
What Does It Do?
CI Guard is a DSH plugin for DeepSeek Harness that scans GitHub Actions workflows for configurations an outside party could exploit. It targets the main entry point of supply-chain attacks: when a workflow uses uses: some-action@main, a compromised upstream account means the next CI run executes under an attacker's control — with your secrets in reach. The plugin grades findings as high, medium, or low and completes a scan in seconds. It is maintained by feely0208 under the MIT license.
Core Features
- High-severity detection: flags unpinned actions,
permissions: write-all, echoed secrets, and script injection. - Medium and low findings: marks
pull_request_targetfor manual review and reports undeclaredpermissionsas low severity. - Rule transparency: lists every rule together with its source, each pointing to specific GitHub Docs and GitHub Security Lab references.
- Report output: generates an HTML report for archiving or sharing with a team.
- Demo mode: shows sample findings without needing a real repository.
How to Use This Plugin?
After enabling it in DSH, run a scan against the current directory to get graded results; use demo mode to preview findings, list the rules to see each rule's basis, and produce an HTML report when you need to hand results off. The scanner matches YAML with regular expressions rather than parsing it, so unusual syntax such as anchors or multi-document files may be missed. Coverage is limited to GitHub Actions — GitLab CI and Jenkins are out of scope — and pull_request_target on its own is not necessarily dangerous, so it still needs human judgment.
How to Troubleshoot This Plugin?
If scan results differ from expectations, first check whether the workflow uses anchors, multi-document syntax, or other unusual YAML forms, since the plugin matches with regular expressions rather than a real parser and may miss them. If you suspect a false positive, list the rules to review the source behind each one and verify against the official GitHub documentation by hand. A medium-severity pull_request_target flag is advisory — judge it against the repository's actual permission setup instead of treating it as a confirmed vulnerability.
This page is an independent rewrite of the plugin's official README — for authoritative documentation and the latest changes, refer to the source: feely0208/dsh-ci-guard. The plugin is third-party code that runs on your machine once installed; inclusion does not imply endorsement — please review the source before installing.