Docs / GitHub Action

GitHub Action

Check the agent steps in your GitHub Actions workflows.

GitHub Action

An agent step in CI is an agent launch like any other, with the repository's secrets beside it. The Curb CI check judges each one the way flanner curb map judges an agent on a laptop: whether untrusted text from issues, comments or pull requests reaches it, who can start it, the secrets and tools it holds, and whether Harden-Runner blocks its outbound traffic.

A step counts when it uses the Claude Code, Codex or Gemini CLI action, or runs one of their commands. Findings name the workflow file and line. They never name a secret.

name: Curb
on:
  pull_request:
  push:
    branches: [main]
permissions:
  contents: read
  security-events: write
jobs:
  curb:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - uses: elandlabs/flanner/actions/curb-ci@v0.16.0
        id: curb
        with:
          fail-on: high
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: ${{ steps.curb.outputs.sarif }}

The checkout keeps no credentials behind. The action writes SARIF, and the last step uploads it to code scanning even when the check fails the job. The action is used by tag, so pin the release you want. The same check runs anywhere as flanner curb ci, which only fails when you pass --fail-on.

Inputs

path

Default: .

The repository folder to check.

sarif

Default: curb-ci.sarif

Where to write the SARIF file.

fail-on

Default: high

Fail the step at this severity or above: high, medium, low or never.

fix

Default: false

Make the one-line fixes that are safe without a person.

Severity: `ci-r1`, version 1

CI-H1

High

Untrusted input reaches the agent, it holds secrets or a token it can use, or runs unsafe, and egress is open.

CI-M1

Medium

Untrusted input reaches the agent, it can run shell commands or write, and egress is open.

CI-M2

Medium

The agent holds secrets or a token it can use, or runs unsafe, and either no untrusted input reaches it or egress is blocked.

CI-L1

Low

Anything else.

Untrusted input means the workflow runs on an event whose content people without write access can write, such as an issue, a comment or pull_request_target. It also means such text is put into the step's prompt or environment.

A token it can use means shell commands beside one of these: the token actions/checkout leaves in the repository, a workflow token that can write, or a step anyone can start.

Egress is open unless the job runs Harden-Runner with egress-policy: block. Audit mode counts as open.

What fix: true changes

Removes allowed_non_write_users, so only people with write access start the step.
Turns Codex's safety-strategy: unsafe into drop-sudo, and sandbox: danger-full-access into workspace-write.
Drops --dangerously-skip-permissions and --yolo.

It edits the workflow files and nothing else. Open a pull request with them, so a person reviews the change. A file that would no longer parse is left as it was. Everything else, such as moving secrets out of the step or adding Harden-Runner, is advice in each finding.

Not checked

Agent steps other than Claude Code's, Codex's and Gemini CLI's, and CI systems other than GitHub Actions.

GitHub Action

Inputs

Severity: ci-r1, version 1

What fix: true changes

Not checked

Severity: `ci-r1`, version 1