supply▌

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.

Identifies high-risk dependencies vulnerable to exploitation or takeover through systematic supply chain analysis. \n \n Evaluates all project dependencies against six risk criteria: single maintainers, unmaintained status, low popularity, high-risk features (FFI, deserialization), past CVEs, and missing security contacts \n Uses the gh CLI tool to query accurate GitHub metrics (stars, open issues, maintainer info) for each dependency \n Generates a structured markdown report with flagged high-r